Secure your dependencies. Ship with confidence.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This package was removed from the npm registry for security reasons.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/enim-earum-maiores (npm) Source: ghsa-malware (d24ba16beda911387c48ddc326ff8f37147f5d45ee7c7fde7e2c78abc7286c71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code snippet exhibits critical security vulnerabilities such as SQL injection and command injection due to unsanitized user inputs. Immediate action is required to implement input validation and sanitization to mitigate these risks.

The code uses non-standard and potentially misleading naming conventions and imports modules with unusual names, executing functions from these modules without clear understanding of their behavior. This could indicate obfuscation or hidden functionality. However, without the actual definitions of these modules, it's not possible to definitively conclude malicious behavior, though the risk is non-negligible.

Live on npm for 56 days, 13 hours and 22 minutes before removal. Socket users were protected even while the package was live.

Malicious code in cards-lib (RubyGems)

The code appears to be a legitimate update process for the 'fca-zeid' package. It compares the local version with the latest version obtained from a remote server and performs the update if necessary. However, there are several potential security risks and anomalies in the code, including unverified JSON retrieval, potential command injection, non-standard version comparison, hard-coded delay timers, potential package instability, and logging of sensitive information. It is recommended to review and modify the code to address these concerns.

Live on npm for 36 days, 23 hours and 48 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in cache-stats (RubyGems)

The script collects information like package name, directory path, home directory, hostname, username, DNS servers, and package.json content, and sends it to a remote server.

Live on npm for 19 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code poses a significant security risk due to the potential for command injection attacks, privilege escalation, and other vulnerabilities. The hardcoded 'sudo' command in the getBin function, lack of input validation, and use of template literals to build commands that will be passed to exec are particularly concerning. The code should be reviewed thoroughly and modified to address these issues before being used.

The provided code has several red flags including unusual module names, a non-standard function 'functame', and hardcoded strings. These factors suggest a potential security risk. However, without access to the source code of the imported modules, it is difficult to conclusively determine if the code is malicious. Further investigation is warranted.

Live on npm for 56 days, 18 hours and 15 minutes before removal. Socket users were protected even while the package was live.

The provided source code contains syntax errors that need to be corrected for proper execution. The primary concern is the unknown nature of the dependencies, which could potentially contain vulnerabilities or malicious code. There is no direct evidence of malicious behavior in the provided code snippet itself.

Live on npm for 43 days, 1 hour and 41 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.

Live on npm for 1 hour and 30 minutes before removal. Socket users were protected even while the package was live.

The code is designed to execute shell commands based on a schedule. While there's no direct evidence of malicious intent, the use of 'shell=True' in subprocess.run poses a significant security risk if untrusted inputs are used. This could potentially be exploited for arbitrary command execution.

Live on pypi for 5 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious and represents a significant privacy concern. It collects sensitive system and user data without apparent consent and sends it to a remote server. It is recommended to avoid using this package.

Live on npm for 4 hours and 19 minutes before removal. Socket users were protected even while the package was live.

The code is suspicious and potentially malicious due to the gathering of system information, use of eval function, obfuscation techniques, and base64-encoded payload. It is advised not to use this code without a proper understanding of the obfuscated and encoded contents.

Live on npm for 1 day, 19 hours and 30 minutes before removal. Socket users were protected even while the package was live.

The code leverages the exec and execSync functions to execute shell commands provided via options.before.commands. This can be potentially dangerous as it allows arbitrary code execution based on external input. However, the code itself does not show explicit signs of malicious intent but needs careful use. Proper input sanitization is crucial to mitigate command injection risks.

Live on npm for 58 minutes before removal. Socket users were protected even while the package was live.

The code appears to manage HTTP communications and includes a mechanism to handle encrypted data. The use of a hardcoded potential key or secret ('an') is a potential security risk if this value is sensitive and should not be hardcoded. There is no explicit evidence of malicious activity in the provided code, but the lack of visibility into the decryption function 'we' means potential malicious behavior cannot be completely ruled out.

This script is exfiltrating sensitive system information to a remote server without the user's consent. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 30 minutes before removal. Socket users were protected even while the package was live.

Malicious code in artisan_plugin (RubyGems)

The script is designed to exfiltrate sensitive system information to an external server via DNS queries. The use of obfuscation and the method of data transmission indicate malicious intent.

Live on npm for 39 minutes before removal. Socket users were protected even while the package was live.

The code sends tracking data over HTTPS to a remote server, but it sends potentially sensitive information without clear user consent or notification. The purpose of tracking user data should be clearly stated and user consent should be obtained before collecting and sending any data. Additionally, the destination of the data is an external server and should be verified as trusted. Overall, the code poses a potential privacy concern for some users and should be used with caution.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This package was removed from the npm registry for security reasons.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/enim-earum-maiores (npm) Source: ghsa-malware (d24ba16beda911387c48ddc326ff8f37147f5d45ee7c7fde7e2c78abc7286c71) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code snippet exhibits critical security vulnerabilities such as SQL injection and command injection due to unsanitized user inputs. Immediate action is required to implement input validation and sanitization to mitigate these risks.

The code uses non-standard and potentially misleading naming conventions and imports modules with unusual names, executing functions from these modules without clear understanding of their behavior. This could indicate obfuscation or hidden functionality. However, without the actual definitions of these modules, it's not possible to definitively conclude malicious behavior, though the risk is non-negligible.

Live on npm for 56 days, 13 hours and 22 minutes before removal. Socket users were protected even while the package was live.

Malicious code in cards-lib (RubyGems)

The code appears to be a legitimate update process for the 'fca-zeid' package. It compares the local version with the latest version obtained from a remote server and performs the update if necessary. However, there are several potential security risks and anomalies in the code, including unverified JSON retrieval, potential command injection, non-standard version comparison, hard-coded delay timers, potential package instability, and logging of sensitive information. It is recommended to review and modify the code to address these concerns.

Live on npm for 36 days, 23 hours and 48 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in cache-stats (RubyGems)

The script collects information like package name, directory path, home directory, hostname, username, DNS servers, and package.json content, and sends it to a remote server.

Live on npm for 19 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code poses a significant security risk due to the potential for command injection attacks, privilege escalation, and other vulnerabilities. The hardcoded 'sudo' command in the getBin function, lack of input validation, and use of template literals to build commands that will be passed to exec are particularly concerning. The code should be reviewed thoroughly and modified to address these issues before being used.

The provided code has several red flags including unusual module names, a non-standard function 'functame', and hardcoded strings. These factors suggest a potential security risk. However, without access to the source code of the imported modules, it is difficult to conclusively determine if the code is malicious. Further investigation is warranted.

Live on npm for 56 days, 18 hours and 15 minutes before removal. Socket users were protected even while the package was live.

The provided source code contains syntax errors that need to be corrected for proper execution. The primary concern is the unknown nature of the dependencies, which could potentially contain vulnerabilities or malicious code. There is no direct evidence of malicious behavior in the provided code snippet itself.

Live on npm for 43 days, 1 hour and 41 minutes before removal. Socket users were protected even while the package was live.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.

Live on npm for 1 hour and 30 minutes before removal. Socket users were protected even while the package was live.

The code is designed to execute shell commands based on a schedule. While there's no direct evidence of malicious intent, the use of 'shell=True' in subprocess.run poses a significant security risk if untrusted inputs are used. This could potentially be exploited for arbitrary command execution.

Live on pypi for 5 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious and represents a significant privacy concern. It collects sensitive system and user data without apparent consent and sends it to a remote server. It is recommended to avoid using this package.

Live on npm for 4 hours and 19 minutes before removal. Socket users were protected even while the package was live.

The code is suspicious and potentially malicious due to the gathering of system information, use of eval function, obfuscation techniques, and base64-encoded payload. It is advised not to use this code without a proper understanding of the obfuscated and encoded contents.

Live on npm for 1 day, 19 hours and 30 minutes before removal. Socket users were protected even while the package was live.

The code leverages the exec and execSync functions to execute shell commands provided via options.before.commands. This can be potentially dangerous as it allows arbitrary code execution based on external input. However, the code itself does not show explicit signs of malicious intent but needs careful use. Proper input sanitization is crucial to mitigate command injection risks.

Live on npm for 58 minutes before removal. Socket users were protected even while the package was live.

The code appears to manage HTTP communications and includes a mechanism to handle encrypted data. The use of a hardcoded potential key or secret ('an') is a potential security risk if this value is sensitive and should not be hardcoded. There is no explicit evidence of malicious activity in the provided code, but the lack of visibility into the decryption function 'we' means potential malicious behavior cannot be completely ruled out.

This script is exfiltrating sensitive system information to a remote server without the user's consent. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 30 minutes before removal. Socket users were protected even while the package was live.

Malicious code in artisan_plugin (RubyGems)

The script is designed to exfiltrate sensitive system information to an external server via DNS queries. The use of obfuscation and the method of data transmission indicate malicious intent.

Live on npm for 39 minutes before removal. Socket users were protected even while the package was live.

The code sends tracking data over HTTPS to a remote server, but it sends potentially sensitive information without clear user consent or notification. The purpose of tracking user data should be clearly stated and user consent should be obtained before collecting and sending any data. Additionally, the destination of the data is an external server and should be verified as trusted. Overall, the code poses a potential privacy concern for some users and should be used with caution.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.