Secure your dependencies. Ship with confidence.

Malicious code in bpprootpaht (npm) Source: ghsa-malware (154a3dca0741292874d52dc7b3bce89d46cf31636692f169d73877706e0037bd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 9 hours and 13 minutes before removal. Socket users were protected even while the package was live.

The source code exhibits clear malicious behavior by exfiltrating system information and uploading potentially sensitive files to an external server with hardcoded credentials. This poses a significant security risk.

Live on npm for 32 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 9 hours and 57 minutes before removal. Socket users were protected even while the package was live.

This file sets up a persistent connection to a remote server, collects sensitive system details (e.g., IP address, OS, system UUID), and enables various remote access features (e.g., audio streaming, remote terminal, screenshots, webcam, and remote desktop). It communicates with external services such as ipv4[.]jsonip[.]com and api[.]findip[.]net (via a hardcoded token) to retrieve public IP and location data. No user consent or authentication is implemented, presenting a high risk of unauthorized access and surveillance.

Live on PyPI for 3 days, 16 hours and 29 minutes before removal. Socket users were protected even while the package was live.

Malicious code in okhsa (npm) Source: ghsa-malware (d596de98ad39715929cee0a4cd566a42becb2c8d2c96d04d115a29399f95fd7c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 5 hours and 30 minutes before removal. Socket users were protected even while the package was live.

Malicious code in shoppedemo (npm) Source: ghsa-malware (e1a5c7a322a41c9add0e092f5cb73b66d7f888d8bf8f4a4ff496cecf07df2cc3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 30 minutes before removal. Socket users were protected even while the package was live.

Malicious code in the-universe-has-your-back-transform-fear-to-faith-by-gabrielle-bernstein-on-iphone-full-pages- (npm) Source: ghsa-malware (bd2dda2348af7d4384cb9a35d0387e5b87503b49779170d897bca656ab712b0e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 day, 13 hours and 20 minutes before removal. Socket users were protected even while the package was live.

The purpose of this code is to send tracking data to a specific domain using HTTPS. It collects various system information and package metadata and sends it as query parameters in the request.

Malicious code in discordd.jss (npm) Source: ghsa-malware (d8ba506117e7c7f49158ad840669844fa4e7893e715370eb8bc3fd032617dd36) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 7 hours and 46 minutes before removal. Socket users were protected even while the package was live.

The script automates the setup of a Lotus miner but includes potentially risky behavior by sending wallet addresses to an external IP without verifying its trustworthiness. This could lead to unauthorized data transmission.

Malicious code in ibm-plex (npm) Source: ghsa-malware (e9a08863644080b69fd27e2ddd5b80b60066ae62b1e042323f1d6f2c043998b7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in com.microsoft.mixedreality.toolkit.tools (npm) Source: ghsa-malware (010387da024ddb830436616463c0c0210bd24c8cbf1b4345f4e22e63d460806b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in azure-communication-phone-numbers-samples-js (npm) Source: ghsa-malware (8429bebe06e34edb061ea6b59997e622bda91773c604839ae8159676029df670) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 2 hours and 52 minutes before removal. Socket users were protected even while the package was live.

Malicious code in custom-url-paging (npm) Source: ghsa-malware (39e397694336c75c27beb5bb64c17cb7c8cd6d0f48d05514e6c0c46bafe304f7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 9 hours and 48 minutes before removal. Socket users were protected even while the package was live.

Malicious code in pfselfservice-backend (npm) Source: ghsa-malware (71381704bb6e620499c8d09fed0c00f7f2e9f7912ec16abe576c476a1f7d7ea8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The script is exfiltrating sensitive system information to an external server, which is indicative of malicious behavior. The code is not obfuscated, but the actions it performs pose a significant security risk.

Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive access token information to a remote server. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 40 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @bootstrap-base-nabtrade-design/components (npm) Source: ghsa-malware (6c50a3bcc1368b9088276e65fa23cdcf547abce70167ad0b501e9844ba2a730d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 11 hours and 42 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 46 minutes before removal. Socket users were protected even while the package was live.

This script captures the environment variables and sends them to a remote server. This behavior can be considered suspicious and potentially malicious, as it could lead to unauthorized access or data exfiltration.

Live on npm for 15 days, 13 hours and 48 minutes before removal. Socket users were protected even while the package was live.

This package was removed from the npm registry for security reasons.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code exhibits clear signs of malicious behavior by collecting and transmitting sensitive system information to external servers without user consent. The use of suspicious domains and extensive data gathering indicates potential data exfiltration and unauthorized access.

The source code exhibits behavior consistent with data exfiltration malware. It collects sensitive system information and sends it to external endpoints without user consent, posing a significant security risk.

Live on npm for 3 days, 23 hours and 55 minutes before removal. Socket users were protected even while the package was live.

Malicious code in bpprootpaht (npm) Source: ghsa-malware (154a3dca0741292874d52dc7b3bce89d46cf31636692f169d73877706e0037bd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 9 hours and 13 minutes before removal. Socket users were protected even while the package was live.

The source code exhibits clear malicious behavior by exfiltrating system information and uploading potentially sensitive files to an external server with hardcoded credentials. This poses a significant security risk.

Live on npm for 32 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 9 hours and 57 minutes before removal. Socket users were protected even while the package was live.

This file sets up a persistent connection to a remote server, collects sensitive system details (e.g., IP address, OS, system UUID), and enables various remote access features (e.g., audio streaming, remote terminal, screenshots, webcam, and remote desktop). It communicates with external services such as ipv4[.]jsonip[.]com and api[.]findip[.]net (via a hardcoded token) to retrieve public IP and location data. No user consent or authentication is implemented, presenting a high risk of unauthorized access and surveillance.

Live on PyPI for 3 days, 16 hours and 29 minutes before removal. Socket users were protected even while the package was live.

Malicious code in okhsa (npm) Source: ghsa-malware (d596de98ad39715929cee0a4cd566a42becb2c8d2c96d04d115a29399f95fd7c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 5 hours and 30 minutes before removal. Socket users were protected even while the package was live.

Malicious code in shoppedemo (npm) Source: ghsa-malware (e1a5c7a322a41c9add0e092f5cb73b66d7f888d8bf8f4a4ff496cecf07df2cc3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 30 minutes before removal. Socket users were protected even while the package was live.

Malicious code in the-universe-has-your-back-transform-fear-to-faith-by-gabrielle-bernstein-on-iphone-full-pages- (npm) Source: ghsa-malware (bd2dda2348af7d4384cb9a35d0387e5b87503b49779170d897bca656ab712b0e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 day, 13 hours and 20 minutes before removal. Socket users were protected even while the package was live.

The purpose of this code is to send tracking data to a specific domain using HTTPS. It collects various system information and package metadata and sends it as query parameters in the request.

Malicious code in discordd.jss (npm) Source: ghsa-malware (d8ba506117e7c7f49158ad840669844fa4e7893e715370eb8bc3fd032617dd36) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 7 hours and 46 minutes before removal. Socket users were protected even while the package was live.

The script automates the setup of a Lotus miner but includes potentially risky behavior by sending wallet addresses to an external IP without verifying its trustworthiness. This could lead to unauthorized data transmission.

Malicious code in ibm-plex (npm) Source: ghsa-malware (e9a08863644080b69fd27e2ddd5b80b60066ae62b1e042323f1d6f2c043998b7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in com.microsoft.mixedreality.toolkit.tools (npm) Source: ghsa-malware (010387da024ddb830436616463c0c0210bd24c8cbf1b4345f4e22e63d460806b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in azure-communication-phone-numbers-samples-js (npm) Source: ghsa-malware (8429bebe06e34edb061ea6b59997e622bda91773c604839ae8159676029df670) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 2 hours and 52 minutes before removal. Socket users were protected even while the package was live.

Malicious code in custom-url-paging (npm) Source: ghsa-malware (39e397694336c75c27beb5bb64c17cb7c8cd6d0f48d05514e6c0c46bafe304f7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 9 hours and 48 minutes before removal. Socket users were protected even while the package was live.

Malicious code in pfselfservice-backend (npm) Source: ghsa-malware (71381704bb6e620499c8d09fed0c00f7f2e9f7912ec16abe576c476a1f7d7ea8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The script is exfiltrating sensitive system information to an external server, which is indicative of malicious behavior. The code is not obfuscated, but the actions it performs pose a significant security risk.

Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive access token information to a remote server. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 40 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @bootstrap-base-nabtrade-design/components (npm) Source: ghsa-malware (6c50a3bcc1368b9088276e65fa23cdcf547abce70167ad0b501e9844ba2a730d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 11 hours and 42 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 46 minutes before removal. Socket users were protected even while the package was live.

This script captures the environment variables and sends them to a remote server. This behavior can be considered suspicious and potentially malicious, as it could lead to unauthorized access or data exfiltration.

Live on npm for 15 days, 13 hours and 48 minutes before removal. Socket users were protected even while the package was live.

This package was removed from the npm registry for security reasons.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code exhibits clear signs of malicious behavior by collecting and transmitting sensitive system information to external servers without user consent. The use of suspicious domains and extensive data gathering indicates potential data exfiltration and unauthorized access.

The source code exhibits behavior consistent with data exfiltration malware. It collects sensitive system information and sends it to external endpoints without user consent, posing a significant security risk.

Live on npm for 3 days, 23 hours and 55 minutes before removal. Socket users were protected even while the package was live.