Secure your dependencies. Ship with confidence.

The code exhibits several concerning behaviors, including potential data manipulation, logging, and obfuscation. It contains functions that could lead to SQL injection and command injection vulnerabilities. The overall assessment suggests a moderate to high risk of malicious behavior.

Live on npm for 18 days, 16 hours and 48 minutes before removal. Socket users were protected even while the package was live.

The code contains several security risks, including inadequate validation of file uploads and external links, potential CSRF vulnerabilities, and exposure of sensitive user data. These issues necessitate immediate attention to enhance the security posture of the application.

Live on pypi for 18 minutes before removal. Socket users were protected even while the package was live.

The code imports multiple external modules with unusual names and calls an unusual function (`functame`) from each of these modules. This pattern is highly unusual and might indicate obfuscation or an attempt to hide malicious behavior. However, without more information on the imported modules or their implementations, it is difficult to definitively determine the presence of malware.

Live on npm for 57 days, 11 hours and 9 minutes before removal. Socket users were protected even while the package was live.

The file contains code that performs malicious actions such as terminating processes associated with security and monitoring tools (e.g., 'Wireshark', 'ProcessHacker'), checking for the presence of debuggers, and forcefully exiting the program if debugging is detected. It attempts to detect proxy usage and the presence of Tor networking by connecting to external services (e.g., requests to 'http://www.google.com' and 'check[.]torproject[.]org'), which can be indicative of efforts to evade detection. Additionally, the code utilizes webhooks to send system information to external servers, potentially leading to unauthorized data exfiltration. These behaviors indicate malicious intent to harm or exploit systems, characteristic of malware.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code primarily aims to provide session recording and event tracking functionality. However, it poses several security risks, including potential data leakage of sensitive user inputs and improper validation of session data. The use of hardcoded uba_id and frequent data transmissions to remote servers are significant concerns.

Live on npm for 1 hour and 1 minute before removal. Socket users were protected even while the package was live.

While the code does not exhibit explicit malicious behavior, it contains significant security risks due to hardcoded credentials, insecure data transmission, and poor data handling practices. The absence of explicit malicious intent is noted, but the potential for exploitation exists.

This script is highly suspicious and poses a significant security risk. It should not be used.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

The code poses a security risk and should be reviewed carefully before use. The lack of input sanitization poses a potential vulnerability, and the script sends data to an external server without clear justification.

This package was removed from the npm registry for security reasons.

This script installs a system package and exfiltrates sensitive video hardware information to a remote server, which is highly suspicious and poses a serious security risk.

This install script is highly suspicious and potentially malicious. It creates a new user with a password and runs a local script named 'evil.sh'. This behavior could be used for unauthorized access or other malicious activities.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The code is likely intended for exfiltrating sensitive information from an environment based on certain conditions. The use of an obfuscated domain and Base64 encoding, combined with the targeted filtering and lack of legitimate functionality, suggests malicious intent.

Live on npm for 1 hour and 27 minutes before removal. Socket users were protected even while the package was live.

The script collects information like package name, current working directory, username, hostname, and IP address, then sends it to a remote server using DNS requests.

Live on npm for 6 days, 21 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The script collects the hostname and the current user and sends this information to a remote server, which poses a significant security risk.

Live on npm for 11 days, 17 hours and 13 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 1 hour and 51 minutes before removal. Socket users were protected even while the package was live.

The script uses curl to send the contents of the '/etc/passwd' file to an external server. This is a clear indication of data exfiltration and is considered highly suspicious and potentially malicious.

Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package

Live on npm for 50 minutes before removal. Socket users were protected even while the package was live.

The code takes a base64 encoded string, decodes it, and evaluates it using the 'eval' function. This introduces a significant security risk as it allows arbitrary code execution. The code should be considered dangerous and should not be used.

Live on npm for 55 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code has functionalities that are potentially dangerous if misused, such as downloading and executing binaries, and manipulating firmware locks. It lacks strong authentication for remote command execution, which is a significant security risk. However, there is no explicit malicious intent identified, but it should be reviewed carefully before deployment due to its capabilities.

The code appears to be a part of a larger framework and includes several potential security concerns that should be further investigated and addressed. The automatic installation of software, the use of hardcoded authorization strings, and the potential for malicious behavior in the 'AutoLogin' function and the 'console.log' override suggest a moderate security risk.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The code is designed to send sensitive system information to a remote server, which is a significant security risk. This behavior is consistent with malicious activity, specifically data exfiltration.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 54 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potentially malicious behavior in terms of user privacy violations through the capture and transmission of sensitive user interaction data. It includes features that could be exploited to collect sensitive information without user consent, raising significant security risks.

Live on npm for 40 minutes before removal. Socket users were protected even while the package was live.

The code exhibits several concerning behaviors, including potential data manipulation, logging, and obfuscation. It contains functions that could lead to SQL injection and command injection vulnerabilities. The overall assessment suggests a moderate to high risk of malicious behavior.

Live on npm for 18 days, 16 hours and 48 minutes before removal. Socket users were protected even while the package was live.

The code contains several security risks, including inadequate validation of file uploads and external links, potential CSRF vulnerabilities, and exposure of sensitive user data. These issues necessitate immediate attention to enhance the security posture of the application.

Live on pypi for 18 minutes before removal. Socket users were protected even while the package was live.

The code imports multiple external modules with unusual names and calls an unusual function (`functame`) from each of these modules. This pattern is highly unusual and might indicate obfuscation or an attempt to hide malicious behavior. However, without more information on the imported modules or their implementations, it is difficult to definitively determine the presence of malware.

Live on npm for 57 days, 11 hours and 9 minutes before removal. Socket users were protected even while the package was live.

The file contains code that performs malicious actions such as terminating processes associated with security and monitoring tools (e.g., 'Wireshark', 'ProcessHacker'), checking for the presence of debuggers, and forcefully exiting the program if debugging is detected. It attempts to detect proxy usage and the presence of Tor networking by connecting to external services (e.g., requests to 'http://www.google.com' and 'check[.]torproject[.]org'), which can be indicative of efforts to evade detection. Additionally, the code utilizes webhooks to send system information to external servers, potentially leading to unauthorized data exfiltration. These behaviors indicate malicious intent to harm or exploit systems, characteristic of malware.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code primarily aims to provide session recording and event tracking functionality. However, it poses several security risks, including potential data leakage of sensitive user inputs and improper validation of session data. The use of hardcoded uba_id and frequent data transmissions to remote servers are significant concerns.

Live on npm for 1 hour and 1 minute before removal. Socket users were protected even while the package was live.

While the code does not exhibit explicit malicious behavior, it contains significant security risks due to hardcoded credentials, insecure data transmission, and poor data handling practices. The absence of explicit malicious intent is noted, but the potential for exploitation exists.

This script is highly suspicious and poses a significant security risk. It should not be used.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

The code poses a security risk and should be reviewed carefully before use. The lack of input sanitization poses a potential vulnerability, and the script sends data to an external server without clear justification.

This package was removed from the npm registry for security reasons.

This script installs a system package and exfiltrates sensitive video hardware information to a remote server, which is highly suspicious and poses a serious security risk.

This install script is highly suspicious and potentially malicious. It creates a new user with a password and runs a local script named 'evil.sh'. This behavior could be used for unauthorized access or other malicious activities.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The code is likely intended for exfiltrating sensitive information from an environment based on certain conditions. The use of an obfuscated domain and Base64 encoding, combined with the targeted filtering and lack of legitimate functionality, suggests malicious intent.

Live on npm for 1 hour and 27 minutes before removal. Socket users were protected even while the package was live.

The script collects information like package name, current working directory, username, hostname, and IP address, then sends it to a remote server using DNS requests.

Live on npm for 6 days, 21 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The script collects the hostname and the current user and sends this information to a remote server, which poses a significant security risk.

Live on npm for 11 days, 17 hours and 13 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 1 hour and 51 minutes before removal. Socket users were protected even while the package was live.

The script uses curl to send the contents of the '/etc/passwd' file to an external server. This is a clear indication of data exfiltration and is considered highly suspicious and potentially malicious.

Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package

Live on npm for 50 minutes before removal. Socket users were protected even while the package was live.

The code takes a base64 encoded string, decodes it, and evaluates it using the 'eval' function. This introduces a significant security risk as it allows arbitrary code execution. The code should be considered dangerous and should not be used.

Live on npm for 55 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code has functionalities that are potentially dangerous if misused, such as downloading and executing binaries, and manipulating firmware locks. It lacks strong authentication for remote command execution, which is a significant security risk. However, there is no explicit malicious intent identified, but it should be reviewed carefully before deployment due to its capabilities.

The code appears to be a part of a larger framework and includes several potential security concerns that should be further investigated and addressed. The automatic installation of software, the use of hardcoded authorization strings, and the potential for malicious behavior in the 'AutoLogin' function and the 'console.log' override suggest a moderate security risk.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

The code is designed to send sensitive system information to a remote server, which is a significant security risk. This behavior is consistent with malicious activity, specifically data exfiltration.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

Live on npm for 54 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potentially malicious behavior in terms of user privacy violations through the capture and transmission of sensitive user interaction data. It includes features that could be exploited to collect sensitive information without user consent, raising significant security risks.

Live on npm for 40 minutes before removal. Socket users were protected even while the package was live.