Secure your dependencies. Ship with confidence.

This script is attempting to exfiltrate sensitive system information (/etc/passwd) to a remote server. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 1 hour and 6 minutes before removal. Socket users were protected even while the package was live.

The provided code is likely attempting to contact a suspicious domain, which could be indicative of data exfiltration, a common tactic used in malicious operations. The use of such a domain raises the risk that the code is part of a supply chain attack, intended to exfiltrate data from the environment in which it runs.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

This package was removed from the npm registry for security reasons.

Live on npm for 15 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @diotoborg/consequuntur-laboriosam (npm) Source: ghsa-malware (eb49cd0fe77b24fa2166acdb2c6e1d966e2c26cd158b50dc2bd961547f9dfc48) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code includes functions that collect sensitive system information such as hardware IDs, MAC addresses, and external IP addresses (e.g., functions like 'check_hwid', 'getallmac', and 'get_external_ipv4'). It performs anti-virtual machine detection to evade analysis environments (the 'antivm' function checks for virtual machine indicators). The code can execute arbitrary system commands and manipulate system settings (e.g., functions like 'command', 'delete', 'restart', and 'shutdown'). It attempts to activate the Windows operating system using hardcoded KMS keys, which is illegal (the 'active_windows' function contains hardcoded KMS keys). The code makes external network requests and includes functions for proxy scraping, potentially facilitating data exfiltration or unauthorized network access. These behaviors are consistent with malware capabilities.

The script collects information like package name, current working directory, username, hostname, and IP address, then sends it to a remote server using DNS requests.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

The code is likely malicious, as it collects and sends environment variables to a remote server using obfuscation and DNS tunneling techniques. This behavior is consistent with data exfiltration.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

The code primarily focuses on automating the Facebook login process, including handling multi-factor authentication and session management. However, there are several potential security concerns: the use of execSync for automatic updates, possible leakage of sensitive information via logging, and the process termination for restarts. While the intent does not seem malicious, these practices can pose security risks and warrant a closer review.

Live on npm for 49 minutes before removal. Socket users were protected even while the package was live.

The script is making a HTTP request to an external URL. This behavior could potentially be used for data exfiltration or to download malicious payloads. It poses a security risk and should be investigated further.

Live on npm for 2 hours and 41 minutes before removal. Socket users were protected even while the package was live.

The code is obfuscated and dynamically executes code, which poses a high risk of executing arbitrary or malicious code. It is recommended to avoid using such techniques in code as it can lead to security vulnerabilities.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

The code collects and transmits detailed system information to a remote server without any indication of user consent, which is indicative of spyware or data exfiltration. This poses a significant privacy and security risk.

Live on npm for 4 days, 23 hours and 34 minutes before removal. Socket users were protected even while the package was live.

The code collects and sends sensitive system information to potentially suspicious external domains without user consent, which is a significant security risk. The use of 'rejectUnauthorized: false' further exacerbates the risk by disabling SSL/TLS certificate validation.

Malicious code in ect-mnotion (npm) Source: ghsa-malware (6cfd30a37e499cbbd889bb3fac228dcf2544a493cb6e55a4b38aeee1ae93916f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 3 hours and 55 minutes before removal. Socket users were protected even while the package was live.

The code is highly malicious, performing both data exfiltration and establishing a reverse shell. It poses a severe security risk and should not be used.

Live on npm for 21 minutes before removal. Socket users were protected even while the package was live.

The code collects sensitive system information and sends it to an external server, which is a clear indicator of malicious behavior. The use of a hardcoded secret key for encryption further exacerbates the security risk.

Live on npm for 10 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates potentially malicious behavior by collecting sensitive information and sending it to remote servers without user consent. The presence of infinite loops and unsanitized data transfers heightens security risks.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code exhibits clear signs of malicious behavior by exfiltrating environment variables to a remote server. This poses a significant security risk as it may include sensitive information such as credentials and API keys.

Live on npm for 37 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potential malicious behavior with data exfiltration and tracking activities, posing a significant security risk. It should be further investigated and potentially removed.

Live on npm for 1 hour and 19 minutes before removal. Socket users were protected even while the package was live.

The code is malicious as it creates a backdoor by adding a root user to the system, posing a severe security risk.

Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package

Live on npm for 46 minutes before removal. Socket users were protected even while the package was live.

The script 'packer/provisioners/post_install.sh' exhibits malicious behavior by performing several harmful actions: - **Deletes user and root history files**: Uses secure deletion methods to remove history files, potentially to conceal malicious activities. - **Clears system log files**: Erases log files from '/var/log', hindering the ability to audit and investigate system actions. - **Disables the root account**: Locks the root account password without ensuring alternative secure administrative access, possibly preventing legitimate administrative operations. - **Sets a weak default password ('changeme') for the 'admin' user**: Introduces a significant security risk by using an easily guessable password, facilitating unauthorized access. These actions can be exploited by an attacker to gain unauthorized access, disrupt legitimate operations, and prevent system recovery. The combination of log and history deletion, disabling of root access, and setting weak credentials indicates malicious intent to compromise system security and conceal nefarious activities.

The obfuscated nature of the code and its suspicious behavior indicate that it may be part of a supply chain attack or contain malicious behavior. The code should be avoided and further investigation is recommended.

Live on npm for 53 minutes before removal. Socket users were protected even while the package was live.

This script is designed to extract sensitive information (access tokens) from a Google Cloud instance and send it to an external server, which poses a significant security risk.

Live on npm for 11 days, 18 hours and 37 minutes before removal. Socket users were protected even while the package was live.

The command 'calc' is not recognized as a standard command, which raises suspicion. It is recommended to investigate the purpose and source of this command before executing it.

Live on npm for 49 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive system information (/etc/passwd) to a remote server. This behavior is highly suspicious and poses a significant security risk.

Live on npm for 1 hour and 6 minutes before removal. Socket users were protected even while the package was live.

The provided code is likely attempting to contact a suspicious domain, which could be indicative of data exfiltration, a common tactic used in malicious operations. The use of such a domain raises the risk that the code is part of a supply chain attack, intended to exfiltrate data from the environment in which it runs.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

This package was removed from the npm registry for security reasons.

Live on npm for 15 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @diotoborg/consequuntur-laboriosam (npm) Source: ghsa-malware (eb49cd0fe77b24fa2166acdb2c6e1d966e2c26cd158b50dc2bd961547f9dfc48) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code includes functions that collect sensitive system information such as hardware IDs, MAC addresses, and external IP addresses (e.g., functions like 'check_hwid', 'getallmac', and 'get_external_ipv4'). It performs anti-virtual machine detection to evade analysis environments (the 'antivm' function checks for virtual machine indicators). The code can execute arbitrary system commands and manipulate system settings (e.g., functions like 'command', 'delete', 'restart', and 'shutdown'). It attempts to activate the Windows operating system using hardcoded KMS keys, which is illegal (the 'active_windows' function contains hardcoded KMS keys). The code makes external network requests and includes functions for proxy scraping, potentially facilitating data exfiltration or unauthorized network access. These behaviors are consistent with malware capabilities.

The script collects information like package name, current working directory, username, hostname, and IP address, then sends it to a remote server using DNS requests.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

The code is likely malicious, as it collects and sends environment variables to a remote server using obfuscation and DNS tunneling techniques. This behavior is consistent with data exfiltration.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

The code primarily focuses on automating the Facebook login process, including handling multi-factor authentication and session management. However, there are several potential security concerns: the use of execSync for automatic updates, possible leakage of sensitive information via logging, and the process termination for restarts. While the intent does not seem malicious, these practices can pose security risks and warrant a closer review.

Live on npm for 49 minutes before removal. Socket users were protected even while the package was live.

The script is making a HTTP request to an external URL. This behavior could potentially be used for data exfiltration or to download malicious payloads. It poses a security risk and should be investigated further.

Live on npm for 2 hours and 41 minutes before removal. Socket users were protected even while the package was live.

The code is obfuscated and dynamically executes code, which poses a high risk of executing arbitrary or malicious code. It is recommended to avoid using such techniques in code as it can lead to security vulnerabilities.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

The code collects and transmits detailed system information to a remote server without any indication of user consent, which is indicative of spyware or data exfiltration. This poses a significant privacy and security risk.

Live on npm for 4 days, 23 hours and 34 minutes before removal. Socket users were protected even while the package was live.

The code collects and sends sensitive system information to potentially suspicious external domains without user consent, which is a significant security risk. The use of 'rejectUnauthorized: false' further exacerbates the risk by disabling SSL/TLS certificate validation.

Malicious code in ect-mnotion (npm) Source: ghsa-malware (6cfd30a37e499cbbd889bb3fac228dcf2544a493cb6e55a4b38aeee1ae93916f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 3 hours and 55 minutes before removal. Socket users were protected even while the package was live.

The code is highly malicious, performing both data exfiltration and establishing a reverse shell. It poses a severe security risk and should not be used.

Live on npm for 21 minutes before removal. Socket users were protected even while the package was live.

The code collects sensitive system information and sends it to an external server, which is a clear indicator of malicious behavior. The use of a hardcoded secret key for encryption further exacerbates the security risk.

Live on npm for 10 minutes before removal. Socket users were protected even while the package was live.

The code demonstrates potentially malicious behavior by collecting sensitive information and sending it to remote servers without user consent. The presence of infinite loops and unsanitized data transfers heightens security risks.

Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.

The code exhibits clear signs of malicious behavior by exfiltrating environment variables to a remote server. This poses a significant security risk as it may include sensitive information such as credentials and API keys.

Live on npm for 37 minutes before removal. Socket users were protected even while the package was live.

The code exhibits potential malicious behavior with data exfiltration and tracking activities, posing a significant security risk. It should be further investigated and potentially removed.

Live on npm for 1 hour and 19 minutes before removal. Socket users were protected even while the package was live.

The code is malicious as it creates a backdoor by adding a root user to the system, posing a severe security risk.

Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package

Live on npm for 46 minutes before removal. Socket users were protected even while the package was live.

The script 'packer/provisioners/post_install.sh' exhibits malicious behavior by performing several harmful actions: - **Deletes user and root history files**: Uses secure deletion methods to remove history files, potentially to conceal malicious activities. - **Clears system log files**: Erases log files from '/var/log', hindering the ability to audit and investigate system actions. - **Disables the root account**: Locks the root account password without ensuring alternative secure administrative access, possibly preventing legitimate administrative operations. - **Sets a weak default password ('changeme') for the 'admin' user**: Introduces a significant security risk by using an easily guessable password, facilitating unauthorized access. These actions can be exploited by an attacker to gain unauthorized access, disrupt legitimate operations, and prevent system recovery. The combination of log and history deletion, disabling of root access, and setting weak credentials indicates malicious intent to compromise system security and conceal nefarious activities.

The obfuscated nature of the code and its suspicious behavior indicate that it may be part of a supply chain attack or contain malicious behavior. The code should be avoided and further investigation is recommended.

Live on npm for 53 minutes before removal. Socket users were protected even while the package was live.

This script is designed to extract sensitive information (access tokens) from a Google Cloud instance and send it to an external server, which poses a significant security risk.

Live on npm for 11 days, 18 hours and 37 minutes before removal. Socket users were protected even while the package was live.

The command 'calc' is not recognized as a standard command, which raises suspicion. It is recommended to investigate the purpose and source of this command before executing it.

Live on npm for 49 minutes before removal. Socket users were protected even while the package was live.