Secure your dependencies. Ship with confidence.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 13 minutes before removal. Socket users were protected even while the package was live.

Malicious code in blackspammerbd-one (PyPI) Source: Oracle using Macaron (3a7030f8a8cf814fe46e26049ad685cd2bae16adadb8115cd5f42a87ed87c941) This package performs data exfiltration and remote control of the system by generating connection codes, file uploads and downloads, and obfuscation. These actions could allow unauthorized access to sensitive information or remote manipulation of the system.

Live on PyPI for 59 minutes before removal. Socket users were protected even while the package was live.

Malicious code in code-snippet-frontend (npm) Source: ghsa-malware (f680de2cbe3d658c28bad18e894dd3fd430e14419dc1cf04f15a54e89f19501d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 18 minutes before removal. Socket users were protected even while the package was live.

Running a shell script with sudo privileges can be dangerous as it has elevated permissions and can potentially harm the system. The contents of 'pre.sh' should be carefully reviewed for any malicious commands.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

Malicious code in brave-core (npm) Source: ghsa-malware (64124298f67bb4effd7c57f151d40e754666278b542f85d9f4f78b80309c5201) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in holvi-message-codes (npm) Source: ghsa-malware (128f00c52bdb7c2ff81548cb45e150d0944943e3546de0973afc8ed2189b9b65) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 25 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

The code poses a high security risk due to its potential for malicious use, and the malware score is moderate to high due to the potential for intentional malicious activity

The code is likely intended for malicious purposes, as it seems to exfiltrate data to a server with hardcoded credentials. The existence of potentially sensitive file extensions such as '.env' among others indicates the possibility of targeted data theft.

Live on npm for 59 minutes before removal. Socket users were protected even while the package was live.

Malicious code in sn-seismic-addons (npm) Source: ghsa-malware (c65ded5619490b98552abae28dfb57a7838397e7094e3f7e9ecc35e215b4f2c5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 5 hours and 32 minutes before removal. Socket users were protected even while the package was live.

Malicious code in aukwrklsfxntqjch (npm) Source: ghsa-malware (0cb7245961363a7795ac31b0813b54297cf394078ea5fa43392661e636a4f794) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in custom-url-paging (npm) Source: ghsa-malware (39e397694336c75c27beb5bb64c17cb7c8cd6d0f48d05514e6c0c46bafe304f7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 5 hours and 45 minutes before removal. Socket users were protected even while the package was live.

Malicious code in clispmner (npm) Source: ghsa-malware (da6cbc1deeb9e8625bfa8359622f41cc2c72dc3abffedda4d8bc7dbdcf32c2ae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 hour and 12 minutes before removal. Socket users were protected even while the package was live.

Malicious code in jessa-vue-components (npm) Source: ghsa-malware (1feeed80d8641e6b7ff1c8e075720c7bbdd735f9694cd6756702585d66a3a8e1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 31 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious and should not be used. It is obfuscated and contains dynamic code execution using eval, indicating that it could contain a backdoor or perform other malicious actions.

Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.

This code is malicious and poses a high security risk. It collects sensitive system and user information and sends it to a remote server. This information could be used for various malicious activities like identity theft, system intrusion, etc. The fact that it is sent to a 'canarytokens.com' domain, which is commonly used for threat detection and not a legitimate data collection endpoint, further supports the malicious intent.

Live on npm for 4 days, 23 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @david-lab/sol-lib (npm) Source: ghsa-malware (e0b5dba42ccf786e68c3da9ea3c922e86a77057afd355a7b4534b190ef156e0b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 1 hour and 21 minutes before removal. Socket users were protected even while the package was live.

The script collects the machine's IP address and sends it to a remote server, which poses a significant security risk and indicates potential malicious behavior.

The code poses a potential security risk due to its capabilities to evade security software and hide files, and its potential for malicious use cannot be ruled out without more context.

Live on PyPI for 20 hours and 32 minutes before removal. Socket users were protected even while the package was live.

Malicious code in dazaar-pay-base (npm) Source: ghsa-malware (064e6c236b32a0d0a08c8715b287ff3065b39848d0de40735e2cc8df7505c1fd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 13 hours and 37 minutes before removal. Socket users were protected even while the package was live.

Malicious code in vue-test-utils-mic (npm) Source: ghsa-malware (c46d77062b96aff23b405d4f5c9b185bd68c62046d47e6739883b5738647457c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in infocus.github.com (npm) Source: ghsa-malware (30ea36de1f6debc9c53bf6a505b4bee4e44d9a46aef9a1eecb240712f04296de) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 hour and 26 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 42 minutes before removal. Socket users were protected even while the package was live.

Malicious code in deompres (npm) Source: ghsa-malware (8fbc3e2ac74aa12b31ceb7da260421d5265829a00cd493b669a3a261f334fb8c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 20 hours and 21 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 13 minutes before removal. Socket users were protected even while the package was live.

Malicious code in blackspammerbd-one (PyPI) Source: Oracle using Macaron (3a7030f8a8cf814fe46e26049ad685cd2bae16adadb8115cd5f42a87ed87c941) This package performs data exfiltration and remote control of the system by generating connection codes, file uploads and downloads, and obfuscation. These actions could allow unauthorized access to sensitive information or remote manipulation of the system.

Live on PyPI for 59 minutes before removal. Socket users were protected even while the package was live.

Malicious code in code-snippet-frontend (npm) Source: ghsa-malware (f680de2cbe3d658c28bad18e894dd3fd430e14419dc1cf04f15a54e89f19501d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 18 minutes before removal. Socket users were protected even while the package was live.

Running a shell script with sudo privileges can be dangerous as it has elevated permissions and can potentially harm the system. The contents of 'pre.sh' should be carefully reviewed for any malicious commands.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

Malicious code in brave-core (npm) Source: ghsa-malware (64124298f67bb4effd7c57f151d40e754666278b542f85d9f4f78b80309c5201) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in holvi-message-codes (npm) Source: ghsa-malware (128f00c52bdb7c2ff81548cb45e150d0944943e3546de0973afc8ed2189b9b65) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 25 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

The code poses a high security risk due to its potential for malicious use, and the malware score is moderate to high due to the potential for intentional malicious activity

The code is likely intended for malicious purposes, as it seems to exfiltrate data to a server with hardcoded credentials. The existence of potentially sensitive file extensions such as '.env' among others indicates the possibility of targeted data theft.

Live on npm for 59 minutes before removal. Socket users were protected even while the package was live.

Malicious code in sn-seismic-addons (npm) Source: ghsa-malware (c65ded5619490b98552abae28dfb57a7838397e7094e3f7e9ecc35e215b4f2c5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 5 hours and 32 minutes before removal. Socket users were protected even while the package was live.

Malicious code in aukwrklsfxntqjch (npm) Source: ghsa-malware (0cb7245961363a7795ac31b0813b54297cf394078ea5fa43392661e636a4f794) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in custom-url-paging (npm) Source: ghsa-malware (39e397694336c75c27beb5bb64c17cb7c8cd6d0f48d05514e6c0c46bafe304f7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 5 hours and 45 minutes before removal. Socket users were protected even while the package was live.

Malicious code in clispmner (npm) Source: ghsa-malware (da6cbc1deeb9e8625bfa8359622f41cc2c72dc3abffedda4d8bc7dbdcf32c2ae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 hour and 12 minutes before removal. Socket users were protected even while the package was live.

Malicious code in jessa-vue-components (npm) Source: ghsa-malware (1feeed80d8641e6b7ff1c8e075720c7bbdd735f9694cd6756702585d66a3a8e1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 31 minutes before removal. Socket users were protected even while the package was live.

The code is highly suspicious and should not be used. It is obfuscated and contains dynamic code execution using eval, indicating that it could contain a backdoor or perform other malicious actions.

Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.

This code is malicious and poses a high security risk. It collects sensitive system and user information and sends it to a remote server. This information could be used for various malicious activities like identity theft, system intrusion, etc. The fact that it is sent to a 'canarytokens.com' domain, which is commonly used for threat detection and not a legitimate data collection endpoint, further supports the malicious intent.

Live on npm for 4 days, 23 hours and 8 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @david-lab/sol-lib (npm) Source: ghsa-malware (e0b5dba42ccf786e68c3da9ea3c922e86a77057afd355a7b4534b190ef156e0b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles legitimate Azure package naming conventions, which could confuse users. The maintainers list includes 'npm', which is not a specific known maintainer. Therefore, it is likely a typosquat.

Live on npm for 1 hour and 21 minutes before removal. Socket users were protected even while the package was live.

The script collects the machine's IP address and sends it to a remote server, which poses a significant security risk and indicates potential malicious behavior.

The code poses a potential security risk due to its capabilities to evade security software and hide files, and its potential for malicious use cannot be ruled out without more context.

Live on PyPI for 20 hours and 32 minutes before removal. Socket users were protected even while the package was live.

Malicious code in dazaar-pay-base (npm) Source: ghsa-malware (064e6c236b32a0d0a08c8715b287ff3065b39848d0de40735e2cc8df7505c1fd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 13 hours and 37 minutes before removal. Socket users were protected even while the package was live.

Malicious code in vue-test-utils-mic (npm) Source: ghsa-malware (c46d77062b96aff23b405d4f5c9b185bd68c62046d47e6739883b5738647457c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in infocus.github.com (npm) Source: ghsa-malware (30ea36de1f6debc9c53bf6a505b4bee4e44d9a46aef9a1eecb240712f04296de) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 hour and 26 minutes before removal. Socket users were protected even while the package was live.

This code poses a serious security risk and should not be used.

Live on npm for 42 minutes before removal. Socket users were protected even while the package was live.

Malicious code in deompres (npm) Source: ghsa-malware (8fbc3e2ac74aa12b31ceb7da260421d5265829a00cd493b669a3a261f334fb8c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 20 hours and 21 minutes before removal. Socket users were protected even while the package was live.