Socket for Open Source Security

This code installs global runtime hooks and redirects specific child-process script calls to the CATBUS_JD_HELPER-configured helper, while selectively hiding or exposing Buffer and process based on call-stack origin. The helper's contents are not provided, so its behavior cannot be determined; the process interception and selective concealment are suspicious and warrant review. No domains, URLs, IP addresses, or credential types are present. Severity: high concern for runtime integrity, with malicious intent not established by this fragment alone.

High-severity credential-sensitive behavior: the code accesses the Chrome Safe Storage credential, extracts and decrypts cookies for iconfont.cn, and returns them to its caller. It creates and removes a temporary cookie-database copy; no network exfiltration is shown in this fragment. Review the caller and package context before use.

This code implements an explicitly destructive behavior: after a challenge failure, it can randomly delete a file found under the filesystem root. It requires administrator/root privileges and the opt-in file ~/.config/i-am-feeling-lucky.txt containing "yes", but the selected target is not constrained to application data, so enabling it risks system or user data loss. Severity is high if enabled and otherwise the destructive path is gated; no network exfiltration or credential theft is shown.

High severity: this background script harvests matching login POST bodies and headers and sends them to a remote handshake endpoint, and it can also upload page cookies and storage snapshots. It periodically reports the active tab URL and device/network identifiers, and accepts remote commands to display overlays or clear storage and uninstall itself. The IP discovery includes api[.]ipify[.]org, ipapi[.]co, httpbin[.]org, and icanhazip[.]com. Consent and tracing are enabled by default, making the collection operational without an explicit user consent step in this code.

Malicious extension detected by Annex

An obfuscated Node.js CLI wrapper supervises a companion agent, manages local state and logs, and forwards user questions. It reads environment variables, command-line arguments, and provider configuration, and can query npm to install, update, or roll back packages while allowing selected lifecycle scripts. It applies token-redaction patterns to logs; no credential exfiltration or malicious network destination is established, though its decoded bridge payload is not fully assessed.

Malicious extension detected by Annex

High-severity authentication bypass: a hardcoded support token in the `x-support-access` header grants administrator access and bypasses session and account checks. This is a potentially intentional backdoor or critically unsafe support mechanism; remove the bypass and rotate the token if it was exposed. No external domains, URLs, or IP addresses are present.

This module is a high-risk loader/dispatcher: it reads Python source code from a runtime-supplied file path and executes it with exec(code), granting the executed payload full capabilities of the running Blender/Python process. It then renders outputs to a runtime-supplied directory without shown path constraints. From this fragment, no specific exfiltration/malware behavior is directly visible, but the architecture enables arbitrary malicious actions if the executed code file is not strictly trusted and controlled.

This code unconditionally collects host and enterprise environment information, including user/domain identifiers, profile paths, VPN/proxy indicators, and selected hosts-file entries, and transmits it over unencrypted HTTP to baidu[.]com:8080/ping. It also logs the full telemetry URL. The claimed self-test purpose is not enforced by the code, making this a significant unauthorized-disclosure risk; severity is high if this endpoint is not explicitly approved.

The code implements a browser face-detection and telemetry component, but embeds a hardcoded bearer credential and automatically attaches it to matching requests to collector.jaak.ai, making the credential extractable by component users and potentially exposing it to matching destinations. It sends browser/device, page, interaction, optional customer/tenant, and IP-derived geolocation telemetry to collector.jaak.ai and ipapi.co; recorded video is emitted to the host application rather than directly uploaded in the shown code. Global XHR/fetch modification and disabling sendBeacon are intrusive, and license validation uses the trace ID in place of the supplied license when one is configured. Severity is high for credential exposure and privacy risk; malicious intent is plausible but not proven by these excerpts.

The fragment performs outbound transfer of user emails, authentication tokens, phone data, and usage telemetry to a hardcoded external admin service. This may be an intended synchronization feature, but the transmission of reusable auth tokens and user data is a significant privacy and credential-exposure concern. Rollback also performs filesystem writes and deletions using stored paths without visible confinement. The supplied portion does not establish whether these behaviors are authorized or how inputs are constrained.

This module is primarily a data retrieval/transformation layer, but it contains a critical unsafe pattern: process_htsc_margin executes eval(content) where content originates from externally returned response stringContent. That creates a direct remote-input-to-arbitrary-code-execution path, making the package unsafe unless the upstream payload is cryptographically trusted and strictly constrained (which the code does not enforce). Secondary concerns include brittle manual parsing (get_tick_handle), extensive concat-in-loops (DoS risk), and broad exception handling that can mask failures.

The visible application code mainly renders power-line infrastructure and implements machine-bound licensing, but the file also contains heavily obfuscated protection/resource-loading logic and wrappers for process-memory manipulation APIs, including WriteProcessMemory and VirtualAlloc. These are significant dual-use indicators; this fragment does not show the wrappers being invoked, a payload, or network exfiltration, so malicious intent is not established. No suspicious domains, URLs, IP addresses, or credential types are visible; hardware identifiers and license files are the data collected or handled. Severity is high for review because the obfuscation and injection-capable APIs prevent reliable verification from this fragment alone.

This install hook sends the system hostname and resolved IP address to https://webhook[.]site/711f31ae-7091-4b68-9631-57b6c6f19980 during installation. This is unexpected host-identifying data exfiltration, making the behavior a high-severity supply-chain concern; no credentials or other collected data are evident in this fragment.

Live on pypi for 17 hours and 2 minutes before removal. Socket users were protected even while the package was live.

This module generates client-side login/authorization pages that capture user credentials and then redirect the browser to a URL containing plaintext credentials in the `user:password@host` authority component—an extremely unsafe pattern that commonly leaks passwords via browser history, logs, and intermediaries. It also embeds template parameters directly into inline JS/HTML without visible escaping (XSS risk if inputs are attacker-controlled) and includes an NTLM-dialog triggering navigation button. While there is no explicit outbound exfiltration code targeting a specific domain in this fragment, the credential-handling/redirect behavior alone presents a high security risk.

High severity: the fragment is structured to conceal and execute an embedded Ruby payload through eval after integrity checking and staged decoding/decompression, and includes anti-analysis checks for common Ruby debuggers and REPLs. No network destination, credential access, or file operation is visible outside the unknown payload. The supplied rescue block appears malformed, potentially preventing execution exactly as pasted; the hidden payload must be extracted and reviewed before use.

Malicious code in evmos-contracts (npm) Source: ghsa-malware (f419cb119fd933884054bde2a713b965f67ffc5d7b81bafe10f4d6dfeb91d9ea) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The fragment performs outbound transfer of user emails, authentication tokens, phone data, and usage telemetry to a hardcoded external admin service. This may be an intended synchronization feature, but the transmission of reusable auth tokens and user data is a significant privacy and credential-exposure concern. Rollback also performs filesystem writes and deletions using stored paths without visible confinement. The supplied portion does not establish whether these behaviors are authorized or how inputs are constrained.

High severity: this code presents extension-provided overlay content, collects form fields including explicitly targeted access/verification tokens, and sends them to the extension runtime. The module itself contains no external URL or direct network request, so the ultimate recipient and subsequent handling cannot be determined from this file alone. The token harvesting and required-token submission are strong indicators of credential collection and warrant review of the message handler and the source of `pj:overlay-show` messages.

This client-side FormCreate UI contains two highly obfuscated, dynamically executed payloads embedded in otherwise functional code; their browser-state and Image/location references suggest possible tracking or beaconing, but the exact destination and collected data cannot be confirmed from the excerpts. The code also renders Markdown through innerHTML without visible sanitization, creating an XSS risk for untrusted content. Severity is high pending decoding and provenance review; the visible AI endpoint is https://api.form-create[.]com/ai/v2/chat/form, and the suspicious encoded logic includes a 172[.] host/IP-prefix check.

This package was published by an author flagged as having bad intent and is considered malicious regardless of version.

Malicious code in talk-lang (npm) Source: ghsa-malware (d8e589e06b10e1f613a0f257df979e7caa57034a7aa4c651550b9578aac971bc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in opencode-skills-collection (npm) Source: amazon-inspector (ad4663af5b87079e1a7cdbfd6f3626801e542f7fdfe79316dec31974dd625941) Package bundles a collection of skill directories containing various helper scripts. Static pattern matches fired on routine network primitives: a Python scraper (bundled-skills/junta-leiloeiros/scripts/base_scraper.py) and an API server script (serve_api.py) that reference `ping`/GET/POST, a benchmark harness (bundled-skills/loki-mode/benchmarks/run-benchmarks.sh), an rclone install helper (bundled-skills/rclone-cli/scripts/install.sh) that runs `curl https://rclone.org` to fetch the rclone installer from its official project domain, and a youtube-notetaker verification script using `curl` against GET endpoints. Matches reflect keyword co-occurrence (curl/ping/GET/POST) in utility scripts rather than exfiltration shapes: no hardcoded attacker C2, no reads of installer-side secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment scraping, no obfuscated destinations, and no install-time lifecycle hook that auto-executes these scripts. The rclone install.sh fetches from rclone's official domain, which is aggressive-but-legitimate runtime tool installation rather than a dropper. The scripts fire only when a user explicitly invokes the corresponding skill, not on `npm install`. Source: ghsa-malware (c84dd18445ee7b0f29f3f76c81efb76a43fa7ef77d4c99b57245f4ef8e72a13a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 47 minutes before removal. Socket users were protected even while the package was live.

An obfuscated Node.js CLI wrapper supervises a core process, manages local state and logs, reads configuration and environment data, and checks npm registries for package updates. It can install or roll back packages while permitting selected lifecycle scripts; visible logging redacts credential-like strings, and the described behavior shows no credential transmission or destructive activity.

This code installs global runtime hooks and redirects specific child-process script calls to the CATBUS_JD_HELPER-configured helper, while selectively hiding or exposing Buffer and process based on call-stack origin. The helper's contents are not provided, so its behavior cannot be determined; the process interception and selective concealment are suspicious and warrant review. No domains, URLs, IP addresses, or credential types are present. Severity: high concern for runtime integrity, with malicious intent not established by this fragment alone.

High-severity credential-sensitive behavior: the code accesses the Chrome Safe Storage credential, extracts and decrypts cookies for iconfont.cn, and returns them to its caller. It creates and removes a temporary cookie-database copy; no network exfiltration is shown in this fragment. Review the caller and package context before use.

This code implements an explicitly destructive behavior: after a challenge failure, it can randomly delete a file found under the filesystem root. It requires administrator/root privileges and the opt-in file ~/.config/i-am-feeling-lucky.txt containing "yes", but the selected target is not constrained to application data, so enabling it risks system or user data loss. Severity is high if enabled and otherwise the destructive path is gated; no network exfiltration or credential theft is shown.

High severity: this background script harvests matching login POST bodies and headers and sends them to a remote handshake endpoint, and it can also upload page cookies and storage snapshots. It periodically reports the active tab URL and device/network identifiers, and accepts remote commands to display overlays or clear storage and uninstall itself. The IP discovery includes api[.]ipify[.]org, ipapi[.]co, httpbin[.]org, and icanhazip[.]com. Consent and tracing are enabled by default, making the collection operational without an explicit user consent step in this code.

Malicious extension detected by Annex

An obfuscated Node.js CLI wrapper supervises a companion agent, manages local state and logs, and forwards user questions. It reads environment variables, command-line arguments, and provider configuration, and can query npm to install, update, or roll back packages while allowing selected lifecycle scripts. It applies token-redaction patterns to logs; no credential exfiltration or malicious network destination is established, though its decoded bridge payload is not fully assessed.

Malicious extension detected by Annex

High-severity authentication bypass: a hardcoded support token in the `x-support-access` header grants administrator access and bypasses session and account checks. This is a potentially intentional backdoor or critically unsafe support mechanism; remove the bypass and rotate the token if it was exposed. No external domains, URLs, or IP addresses are present.

This module is a high-risk loader/dispatcher: it reads Python source code from a runtime-supplied file path and executes it with exec(code), granting the executed payload full capabilities of the running Blender/Python process. It then renders outputs to a runtime-supplied directory without shown path constraints. From this fragment, no specific exfiltration/malware behavior is directly visible, but the architecture enables arbitrary malicious actions if the executed code file is not strictly trusted and controlled.

This code unconditionally collects host and enterprise environment information, including user/domain identifiers, profile paths, VPN/proxy indicators, and selected hosts-file entries, and transmits it over unencrypted HTTP to baidu[.]com:8080/ping. It also logs the full telemetry URL. The claimed self-test purpose is not enforced by the code, making this a significant unauthorized-disclosure risk; severity is high if this endpoint is not explicitly approved.

The code implements a browser face-detection and telemetry component, but embeds a hardcoded bearer credential and automatically attaches it to matching requests to collector.jaak.ai, making the credential extractable by component users and potentially exposing it to matching destinations. It sends browser/device, page, interaction, optional customer/tenant, and IP-derived geolocation telemetry to collector.jaak.ai and ipapi.co; recorded video is emitted to the host application rather than directly uploaded in the shown code. Global XHR/fetch modification and disabling sendBeacon are intrusive, and license validation uses the trace ID in place of the supplied license when one is configured. Severity is high for credential exposure and privacy risk; malicious intent is plausible but not proven by these excerpts.

The fragment performs outbound transfer of user emails, authentication tokens, phone data, and usage telemetry to a hardcoded external admin service. This may be an intended synchronization feature, but the transmission of reusable auth tokens and user data is a significant privacy and credential-exposure concern. Rollback also performs filesystem writes and deletions using stored paths without visible confinement. The supplied portion does not establish whether these behaviors are authorized or how inputs are constrained.

This module is primarily a data retrieval/transformation layer, but it contains a critical unsafe pattern: process_htsc_margin executes eval(content) where content originates from externally returned response stringContent. That creates a direct remote-input-to-arbitrary-code-execution path, making the package unsafe unless the upstream payload is cryptographically trusted and strictly constrained (which the code does not enforce). Secondary concerns include brittle manual parsing (get_tick_handle), extensive concat-in-loops (DoS risk), and broad exception handling that can mask failures.

The visible application code mainly renders power-line infrastructure and implements machine-bound licensing, but the file also contains heavily obfuscated protection/resource-loading logic and wrappers for process-memory manipulation APIs, including WriteProcessMemory and VirtualAlloc. These are significant dual-use indicators; this fragment does not show the wrappers being invoked, a payload, or network exfiltration, so malicious intent is not established. No suspicious domains, URLs, IP addresses, or credential types are visible; hardware identifiers and license files are the data collected or handled. Severity is high for review because the obfuscation and injection-capable APIs prevent reliable verification from this fragment alone.

This install hook sends the system hostname and resolved IP address to https://webhook[.]site/711f31ae-7091-4b68-9631-57b6c6f19980 during installation. This is unexpected host-identifying data exfiltration, making the behavior a high-severity supply-chain concern; no credentials or other collected data are evident in this fragment.

Live on pypi for 17 hours and 2 minutes before removal. Socket users were protected even while the package was live.

This module generates client-side login/authorization pages that capture user credentials and then redirect the browser to a URL containing plaintext credentials in the `user:password@host` authority component—an extremely unsafe pattern that commonly leaks passwords via browser history, logs, and intermediaries. It also embeds template parameters directly into inline JS/HTML without visible escaping (XSS risk if inputs are attacker-controlled) and includes an NTLM-dialog triggering navigation button. While there is no explicit outbound exfiltration code targeting a specific domain in this fragment, the credential-handling/redirect behavior alone presents a high security risk.

High severity: the fragment is structured to conceal and execute an embedded Ruby payload through eval after integrity checking and staged decoding/decompression, and includes anti-analysis checks for common Ruby debuggers and REPLs. No network destination, credential access, or file operation is visible outside the unknown payload. The supplied rescue block appears malformed, potentially preventing execution exactly as pasted; the hidden payload must be extracted and reviewed before use.

Malicious code in evmos-contracts (npm) Source: ghsa-malware (f419cb119fd933884054bde2a713b965f67ffc5d7b81bafe10f4d6dfeb91d9ea) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The fragment performs outbound transfer of user emails, authentication tokens, phone data, and usage telemetry to a hardcoded external admin service. This may be an intended synchronization feature, but the transmission of reusable auth tokens and user data is a significant privacy and credential-exposure concern. Rollback also performs filesystem writes and deletions using stored paths without visible confinement. The supplied portion does not establish whether these behaviors are authorized or how inputs are constrained.

High severity: this code presents extension-provided overlay content, collects form fields including explicitly targeted access/verification tokens, and sends them to the extension runtime. The module itself contains no external URL or direct network request, so the ultimate recipient and subsequent handling cannot be determined from this file alone. The token harvesting and required-token submission are strong indicators of credential collection and warrant review of the message handler and the source of `pj:overlay-show` messages.

This client-side FormCreate UI contains two highly obfuscated, dynamically executed payloads embedded in otherwise functional code; their browser-state and Image/location references suggest possible tracking or beaconing, but the exact destination and collected data cannot be confirmed from the excerpts. The code also renders Markdown through innerHTML without visible sanitization, creating an XSS risk for untrusted content. Severity is high pending decoding and provenance review; the visible AI endpoint is https://api.form-create[.]com/ai/v2/chat/form, and the suspicious encoded logic includes a 172[.] host/IP-prefix check.

This package was published by an author flagged as having bad intent and is considered malicious regardless of version.

Malicious code in talk-lang (npm) Source: ghsa-malware (d8e589e06b10e1f613a0f257df979e7caa57034a7aa4c651550b9578aac971bc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in opencode-skills-collection (npm) Source: amazon-inspector (ad4663af5b87079e1a7cdbfd6f3626801e542f7fdfe79316dec31974dd625941) Package bundles a collection of skill directories containing various helper scripts. Static pattern matches fired on routine network primitives: a Python scraper (bundled-skills/junta-leiloeiros/scripts/base_scraper.py) and an API server script (serve_api.py) that reference `ping`/GET/POST, a benchmark harness (bundled-skills/loki-mode/benchmarks/run-benchmarks.sh), an rclone install helper (bundled-skills/rclone-cli/scripts/install.sh) that runs `curl https://rclone.org` to fetch the rclone installer from its official project domain, and a youtube-notetaker verification script using `curl` against GET endpoints. Matches reflect keyword co-occurrence (curl/ping/GET/POST) in utility scripts rather than exfiltration shapes: no hardcoded attacker C2, no reads of installer-side secret paths (~/.aws, ~/.ssh, ~/.npmrc), no environment scraping, no obfuscated destinations, and no install-time lifecycle hook that auto-executes these scripts. The rclone install.sh fetches from rclone's official domain, which is aggressive-but-legitimate runtime tool installation rather than a dropper. The scripts fire only when a user explicitly invokes the corresponding skill, not on `npm install`. Source: ghsa-malware (c84dd18445ee7b0f29f3f76c81efb76a43fa7ef77d4c99b57245f4ef8e72a13a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 47 minutes before removal. Socket users were protected even while the package was live.

An obfuscated Node.js CLI wrapper supervises a core process, manages local state and logs, reads configuration and environment data, and checks npm registries for package updates. It can install or roll back packages while permitting selected lifecycle scripts; visible logging redacts credential-like strings, and the described behavior shows no credential transmission or destructive activity.