Secure your dependencies. Ship with confidence.

This code poses a serious security risk and should not be used.

Live on npm for 27 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by exfiltrating environment variables to a suspicious domain. This poses a significant security risk as it can lead to data theft and unauthorized access to sensitive information.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

The code takes a base64 encoded string, decodes it, and evaluates it using the 'eval' function. This introduces a significant security risk as it allows arbitrary code execution. The code should be considered dangerous and should not be used.

Live on npm for 59 minutes before removal. Socket users were protected even while the package was live.

This script executes a JavaScript file and then deletes it. While this behavior may not be inherently malicious, it is suspicious and could potentially be used for malicious purposes.

Live on npm for 2 days, 22 hours and 49 minutes before removal. Socket users were protected even while the package was live.

The code includes utility functions for string manipulation, data formatting, and system checks. However, it also exhibits potentially risky behaviors such as downloading and running executable files and interacting with the file system. Further investigation and review of the code, including the usage of external libraries, is recommended to ensure security and mitigate potential risks.

Live on npm for 3 days, 6 hours and 11 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potential security risks and anomalies, including the use of spawnSync and process.execPath, as well as inadequate validation of user input. Further review and testing are recommended to address these concerns.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

This script is highly suspicious and likely malicious. It downloads a payload from a potentially malicious server and sends sensitive system information to it. This behavior poses a significant security risk.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

The code is suspicious as it retrieves update information from an unverified external source and uses 'execSync' to run shell commands, which could lead to remote code execution if the external content is compromised. Furthermore, the code attempts to forcibly update and reinstall packages which is not typical for secure update practices.

Live on npm for 16 minutes before removal. Socket users were protected even while the package was live.

The use of eval() in this context is potentially dangerous as it can lead to JavaScript code injection vulnerabilities if the input is not strictly controlled or sanitized. However, there is no direct evidence of intentional malicious behavior within this snippet.

Live on npm for 114 days, 22 hours and 36 minutes before removal. Socket users were protected even while the package was live.

The code is performing malicious actions by collecting and sending sensitive system information to a remote server. This includes private IP address, username, hostname, current directory, and contents of /etc/passwd. The actions indicate a high risk of data theft and unauthorized data exfiltration.

Live on npm for 38 minutes before removal. Socket users were protected even while the package was live.

The code appears to be obfuscated and has several unusual patterns and hardcoded values. It sends a POST request to a remote server with data encoded in base64. The purpose of this request is not clear and could potentially be malicious. Further investigation and analysis are recommended.

The code attempts to collect and send environment variables over the network. It contains hardcoded values, unusual string manipulations, and unnecessary complexity. While it doesn't contain explicit malware, the behavior of collecting and sending environment variables could be considered malicious in certain contexts.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

This file is encrypted with PyArmor

The code contains dynamic evaluation of parameters 't' and 'n' in the 'Zo' function, which could lead to security risks if untrusted input is used. Proper input validation and sanitization should be implemented to prevent malicious behavior.

Live on npm for 3 days, 7 hours and 15 minutes before removal. Socket users were protected even while the package was live.

The provided code has unusual variable and function names, which may be indicative of obfuscation or an attempt to disguise its true purpose. The imported modules have non-descriptive names, and their origins and behavior are not clear from the code snippet alone. Without further information about these modules, it is challenging to fully assess the intent and security risk. The code itself does not perform any immediately obvious malicious actions, but the use of these potentially suspicious modules suggests that further investigation is warranted.

Live on npm for 43 days, 3 hours and 51 minutes before removal. Socket users were protected even while the package was live.

The script collects information like hostname, operating system, user information, and current path, then sends it to a remote server.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

The code is intended to start a local server for development or testing purposes. There is potential risk if the binaries that are executed are not from a trusted source or if they have been tampered with. However, without further evidence of malicious intent or behavior in the actual binaries being executed, it is not possible to conclude definitively that this code contains malware.

This script is highly suspicious and indicates an attempt to establish a reverse shell connection to a remote server. This behavior is considered malicious and poses a significant security risk.

Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates malicious behavior by exfiltrating sensitive system and environment data using DNS queries. The use of a specific DNS server and data obfuscation techniques indicate an attempt to conceal this activity. This poses a significant security risk.

Live on npm for 16 minutes before removal. Socket users were protected even while the package was live.

The provided code has unusual characteristics in its library names and the functions being called. While no direct malicious activity is detected, the unconventional naming and functionality warrant further investigation to ensure these libraries do not harbor hidden threats.

Live on npm for 56 days, 20 hours and 52 minutes before removal. Socket users were protected even while the package was live.

The purpose of this code appears to be collecting specific environment variables and package information, compressing and encoding it, and sending it over HTTP to a remote domain. The intent and purpose of this behavior are unclear from the provided code fragment alone.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code is not malicious but is vulnerable to SQL injection due to the lack of input validation and sanitization for the 'rawQuery' parameter. The misuse of connection.end() could lead to resource management issues.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

The code contains a directive that listens for clicks outside the element and triggers a handler function, which could be a potential security risk if the handler function is not properly validated and sanitized. Further review of the handler function is required to assess potential security risks.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code snippet exhibits critical security vulnerabilities such as SQL injection and command injection due to unsanitized user inputs. Immediate action is required to implement input validation and sanitization to mitigate these risks.

Live on pypi for 8 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates clear malicious behavior by exfiltrating environment variables, using obfuscation techniques, and employing DNS tunneling for data exfiltration. The high scores in malware, obfuscation, and risk are justified based on the observed actions in the code.

Live on npm for 1 hour and 8 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 27 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by exfiltrating environment variables to a suspicious domain. This poses a significant security risk as it can lead to data theft and unauthorized access to sensitive information.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

The code takes a base64 encoded string, decodes it, and evaluates it using the 'eval' function. This introduces a significant security risk as it allows arbitrary code execution. The code should be considered dangerous and should not be used.

Live on npm for 59 minutes before removal. Socket users were protected even while the package was live.

This script executes a JavaScript file and then deletes it. While this behavior may not be inherently malicious, it is suspicious and could potentially be used for malicious purposes.

Live on npm for 2 days, 22 hours and 49 minutes before removal. Socket users were protected even while the package was live.

The code includes utility functions for string manipulation, data formatting, and system checks. However, it also exhibits potentially risky behaviors such as downloading and running executable files and interacting with the file system. Further investigation and review of the code, including the usage of external libraries, is recommended to ensure security and mitigate potential risks.

Live on npm for 3 days, 6 hours and 11 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potential security risks and anomalies, including the use of spawnSync and process.execPath, as well as inadequate validation of user input. Further review and testing are recommended to address these concerns.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

This script is highly suspicious and likely malicious. It downloads a payload from a potentially malicious server and sends sensitive system information to it. This behavior poses a significant security risk.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

The code is suspicious as it retrieves update information from an unverified external source and uses 'execSync' to run shell commands, which could lead to remote code execution if the external content is compromised. Furthermore, the code attempts to forcibly update and reinstall packages which is not typical for secure update practices.

Live on npm for 16 minutes before removal. Socket users were protected even while the package was live.

The use of eval() in this context is potentially dangerous as it can lead to JavaScript code injection vulnerabilities if the input is not strictly controlled or sanitized. However, there is no direct evidence of intentional malicious behavior within this snippet.

Live on npm for 114 days, 22 hours and 36 minutes before removal. Socket users were protected even while the package was live.

The code is performing malicious actions by collecting and sending sensitive system information to a remote server. This includes private IP address, username, hostname, current directory, and contents of /etc/passwd. The actions indicate a high risk of data theft and unauthorized data exfiltration.

Live on npm for 38 minutes before removal. Socket users were protected even while the package was live.

The code appears to be obfuscated and has several unusual patterns and hardcoded values. It sends a POST request to a remote server with data encoded in base64. The purpose of this request is not clear and could potentially be malicious. Further investigation and analysis are recommended.

The code attempts to collect and send environment variables over the network. It contains hardcoded values, unusual string manipulations, and unnecessary complexity. While it doesn't contain explicit malware, the behavior of collecting and sending environment variables could be considered malicious in certain contexts.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

This file is encrypted with PyArmor

The code contains dynamic evaluation of parameters 't' and 'n' in the 'Zo' function, which could lead to security risks if untrusted input is used. Proper input validation and sanitization should be implemented to prevent malicious behavior.

Live on npm for 3 days, 7 hours and 15 minutes before removal. Socket users were protected even while the package was live.

The provided code has unusual variable and function names, which may be indicative of obfuscation or an attempt to disguise its true purpose. The imported modules have non-descriptive names, and their origins and behavior are not clear from the code snippet alone. Without further information about these modules, it is challenging to fully assess the intent and security risk. The code itself does not perform any immediately obvious malicious actions, but the use of these potentially suspicious modules suggests that further investigation is warranted.

Live on npm for 43 days, 3 hours and 51 minutes before removal. Socket users were protected even while the package was live.

The script collects information like hostname, operating system, user information, and current path, then sends it to a remote server.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

The code is intended to start a local server for development or testing purposes. There is potential risk if the binaries that are executed are not from a trusted source or if they have been tampered with. However, without further evidence of malicious intent or behavior in the actual binaries being executed, it is not possible to conclude definitively that this code contains malware.

This script is highly suspicious and indicates an attempt to establish a reverse shell connection to a remote server. This behavior is considered malicious and poses a significant security risk.

Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates malicious behavior by exfiltrating sensitive system and environment data using DNS queries. The use of a specific DNS server and data obfuscation techniques indicate an attempt to conceal this activity. This poses a significant security risk.

Live on npm for 16 minutes before removal. Socket users were protected even while the package was live.

The provided code has unusual characteristics in its library names and the functions being called. While no direct malicious activity is detected, the unconventional naming and functionality warrant further investigation to ensure these libraries do not harbor hidden threats.

Live on npm for 56 days, 20 hours and 52 minutes before removal. Socket users were protected even while the package was live.

The purpose of this code appears to be collecting specific environment variables and package information, compressing and encoding it, and sending it over HTTP to a remote domain. The intent and purpose of this behavior are unclear from the provided code fragment alone.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code is not malicious but is vulnerable to SQL injection due to the lack of input validation and sanitization for the 'rawQuery' parameter. The misuse of connection.end() could lead to resource management issues.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

The code contains a directive that listens for clicks outside the element and triggers a handler function, which could be a potential security risk if the handler function is not properly validated and sanitized. Further review of the handler function is required to assess potential security risks.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code snippet exhibits critical security vulnerabilities such as SQL injection and command injection due to unsanitized user inputs. Immediate action is required to implement input validation and sanitization to mitigate these risks.

Live on pypi for 8 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates clear malicious behavior by exfiltrating environment variables, using obfuscation techniques, and employing DNS tunneling for data exfiltration. The high scores in malware, obfuscation, and risk are justified based on the observed actions in the code.

Live on npm for 1 hour and 8 minutes before removal. Socket users were protected even while the package was live.