Quickly evaluate the security and health of any open source package.
symphony-pegasus-aht662
1.0.0
by afifaljafari112
Removed from npm
Blocked by Socket
The code snippet primarily involves calling functions from various imported modules with unconventional names, which raises suspicion due to the lack of context and standard practices. The invalid syntax and undefined methods further suggest potential obfuscation or errors. However, without more information about these modules and their implementations, it's challenging to definitively determine malicious intent. There are no clear sources or sinks within this snippet alone.
Live on npm for 57 days, 18 hours and 52 minutes before removal. Socket users were protected even while the package was live.
fluro-ui
2.0.12
by jpdhackerone05
Live on npm
Blocked by Socket
This source code is malicious. It performs stealthy data exfiltration of sensitive system and environment information to a suspicious hardcoded IP address. The evasion techniques and randomized network behavior indicate intentional concealment. This represents a serious security and privacy risk and should be flagged as high severity malware.
refocus-logging
1.1.0
by pepolanza
Removed from npm
Blocked by Socket
This script is potentially malicious as it sends the hostname of the machine to a remote server, which could be used for tracking or unauthorized access.
Live on npm for 16 days, 21 hours and 5 minutes before removal. Socket users were protected even while the package was live.
twilio-chat-console-webapp
2.0.4
by goludeep42
Removed from npm
Blocked by Socket
This module does not execute any code or perform any actual operations, but it contains a suspicious message.
Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.
seller-base.environment
6.5.8
by taka14179
Removed from npm
Blocked by Socket
The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.
Live on npm for 9 hours and 57 minutes before removal. Socket users were protected even while the package was live.
dir-tree-generator
1.0.0
by cyberch3f
Removed from npm
Blocked by Socket
This file contains heavily obfuscated code that collects sensitive system information and environment variables (including SecretId, accessKeySecret, and other credentials), encrypts this data, and exfiltrates it to remote servers via HTTPS requests. The code performs various system checks and will exit if certain conditions are not met, suggesting evasion techniques to avoid detection in certain environments. The malicious behavior includes accessing sensitive environment variables, collecting network configuration data, and transmitting encrypted data without user consent. The extensive obfuscation techniques indicate a deliberate attempt to hide the code's true purpose.
Live on npm for 40 days, 6 hours and 6 minutes before removal. Socket users were protected even while the package was live.
rb-web-popup
0.1.0
by deeshantdh
Removed from npm
Blocked by Socket
The code is likely involved in malicious behavior by collecting sensitive system and user information and sending it to a suspicious domain without user consent. This could lead to privacy violations and potential security risks.
Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.
curri-slack
0.4.2
Removed from npm
Blocked by Socket
The source code exhibits clear signs of malicious behavior, including unauthorized data exfiltration of system and project information to external servers. This poses a significant security risk.
Live on npm for 14 minutes before removal. Socket users were protected even while the package was live.
lodashclonqedeew
1.2.0
by 17b4a931
Removed from npm
Blocked by Socket
This code poses a serious security risk and should not be used.
Live on npm for 11 minutes before removal. Socket users were protected even while the package was live.
testcucmanh4
1.9999.9999
by greybtw
Removed from npm
Blocked by Socket
The script fetches content from a local IP address and echoes a threatening message. This behavior is suspicious and could potentially be part of a malicious activity.
Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.
azure-graphrbac
3.1.4
Removed from npm
Blocked by Socket
Possible typosquat of azure azure-graphrbac is a malicious package that exfiltrates system (Ex - hostname) and project details to external servers.
Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.
bancolombia-design-system
3.1.3
by cbello2332
Removed from npm
Blocked by Socket
The script attempts to connect to a remote server at IP address 192.168.20.38 on port 4444, which is a common technique used for establishing a reverse shell. This poses a significant security risk.
Live on npm for 7 hours and 15 minutes before removal. Socket users were protected even while the package was live.
undici-jey
6.21.2
by jrjs
Live on npm
Blocked by Socket
The code is obfuscated using base64 encoding, which can hide its true purpose. Without further analysis of the decoded WebAssembly module, it's difficult to assess the security risks or potential malicious behavior. The reports are flawed and do not provide any useful information.
azure-graphrbac
6.2.6
Removed from npm
Blocked by Socket
Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package
Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.
fca-milo-mod
0.0.1-security
by ndphuc1a
Removed from npm
Blocked by Socket
The provided code is heavily obfuscated and contains potentially malicious behavior such as dynamic evaluation of code and potential network communication. The presence of obfuscated code, dynamic evaluation, and the potential for unauthorized data transmission raise significant security concerns. It is recommended to thoroughly review the code and validate its integrity.
Live on npm for 1 hour and 53 minutes before removal. Socket users were protected even while the package was live.
pupeteer-recorder
1.0.7
by uw2rzwdfmxfes
Removed from npm
Blocked by Socket
The code poses a significant security risk due to its behavior of downloading and executing remote files without user consent. The heavy obfuscation further raises concerns about its intent, suggesting potential malicious activity.
Live on npm for 5 days, 17 hours and 48 minutes before removal. Socket users were protected even while the package was live.
client-utility-module
1.0.0
by rouk
Removed from npm
Blocked by Socket
The code is malicious, performing unauthorized exfiltration of sensitive system environment variables and hostname to a suspicious external domain. This represents a serious security risk and privacy violation. The code is not obfuscated but clearly designed for covert data theft.
Live on npm for 19 days, 14 hours and 57 minutes before removal. Socket users were protected even while the package was live.
feedback-utils
15.999.999
Removed from npm
Blocked by Socket
The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.
Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.
ea5
6.999.0
by test-qw
Removed from npm
Blocked by Socket
The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.
Live on npm for 11 minutes before removal. Socket users were protected even while the package was live.
cms-vue-boilerplate
9.9.9
by darkry741
Live on npm
Blocked by Socket
The script attempts to send sensitive system information (the contents of '/etc/passwd') to an external server, indicating malicious behavior and a high security risk.
rc-network
1.0.23
Removed from npm
Blocked by Socket
Possible typosquat of [rc-cascader](https://socket.dev/npm/package/rc-cascader) Explanation: The package 'rc-network' is labeled as a security holding package, which is often used to prevent typosquatting. The name 'rc-network' is similar enough to 'rc-cascader' to potentially confuse users, especially since both start with 'rc-'. There is no indication of a distinct purpose, intentional play on words, or known maintainers, making it suspicious.
Live on npm for 1 hour before removal. Socket users were protected even while the package was live.
cgpt_burn_tracker_frontend
1.0.2
by zin_min_phyo
Removed from npm
Blocked by Socket
The code is designed to exfiltrate sensitive system and user information to a remote server, which is indicative of malicious behavior. It poses a significant security risk due to the potential misuse of the exfiltrated data.
Live on npm for 6 hours and 39 minutes before removal. Socket users were protected even while the package was live.
pkg-lumina-test
5.0.0
by avishek18
Removed from npm
Blocked by Socket
The script is trying to make a request to a remote server using the hostname command. This behavior could potentially be used for data exfiltration or to trigger malicious actions on the server.
Live on npm for 1 hour and 25 minutes before removal. Socket users were protected even while the package was live.
atlas-query-editor
0.0.1
by bluehackhds
Removed from npm
Blocked by Socket
The code exhibits malicious behavior by collecting and sending sensitive system and package information to a suspicious domain without user consent. This poses a significant security risk.
Live on npm for 4 hours and 40 minutes before removal. Socket users were protected even while the package was live.
wallet-add-chain
1.0.2
by syt4sh1
Removed from npm
Blocked by Socket
This code snippet is likely malicious. It is designed to extract sensitive system and process data and send them over the network to a certain target URL. It also has the potential to execute shell commands. These behaviors suggest a potential backdoor or information stealing malware.
Live on npm for 10 days, 22 hours and 27 minutes before removal. Socket users were protected even while the package was live.
symphony-pegasus-aht662
1.0.0
by afifaljafari112
Removed from npm
Blocked by Socket
The code snippet primarily involves calling functions from various imported modules with unconventional names, which raises suspicion due to the lack of context and standard practices. The invalid syntax and undefined methods further suggest potential obfuscation or errors. However, without more information about these modules and their implementations, it's challenging to definitively determine malicious intent. There are no clear sources or sinks within this snippet alone.
Live on npm for 57 days, 18 hours and 52 minutes before removal. Socket users were protected even while the package was live.
fluro-ui
2.0.12
by jpdhackerone05
Live on npm
Blocked by Socket
This source code is malicious. It performs stealthy data exfiltration of sensitive system and environment information to a suspicious hardcoded IP address. The evasion techniques and randomized network behavior indicate intentional concealment. This represents a serious security and privacy risk and should be flagged as high severity malware.
refocus-logging
1.1.0
by pepolanza
Removed from npm
Blocked by Socket
This script is potentially malicious as it sends the hostname of the machine to a remote server, which could be used for tracking or unauthorized access.
Live on npm for 16 days, 21 hours and 5 minutes before removal. Socket users were protected even while the package was live.
twilio-chat-console-webapp
2.0.4
by goludeep42
Removed from npm
Blocked by Socket
This module does not execute any code or perform any actual operations, but it contains a suspicious message.
Live on npm for 8 minutes before removal. Socket users were protected even while the package was live.
seller-base.environment
6.5.8
by taka14179
Removed from npm
Blocked by Socket
The code exhibits malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a high security risk and potential for data theft.
Live on npm for 9 hours and 57 minutes before removal. Socket users were protected even while the package was live.
dir-tree-generator
1.0.0
by cyberch3f
Removed from npm
Blocked by Socket
This file contains heavily obfuscated code that collects sensitive system information and environment variables (including SecretId, accessKeySecret, and other credentials), encrypts this data, and exfiltrates it to remote servers via HTTPS requests. The code performs various system checks and will exit if certain conditions are not met, suggesting evasion techniques to avoid detection in certain environments. The malicious behavior includes accessing sensitive environment variables, collecting network configuration data, and transmitting encrypted data without user consent. The extensive obfuscation techniques indicate a deliberate attempt to hide the code's true purpose.
Live on npm for 40 days, 6 hours and 6 minutes before removal. Socket users were protected even while the package was live.
rb-web-popup
0.1.0
by deeshantdh
Removed from npm
Blocked by Socket
The code is likely involved in malicious behavior by collecting sensitive system and user information and sending it to a suspicious domain without user consent. This could lead to privacy violations and potential security risks.
Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.
curri-slack
0.4.2
Removed from npm
Blocked by Socket
The source code exhibits clear signs of malicious behavior, including unauthorized data exfiltration of system and project information to external servers. This poses a significant security risk.
Live on npm for 14 minutes before removal. Socket users were protected even while the package was live.
lodashclonqedeew
1.2.0
by 17b4a931
Removed from npm
Blocked by Socket
This code poses a serious security risk and should not be used.
Live on npm for 11 minutes before removal. Socket users were protected even while the package was live.
testcucmanh4
1.9999.9999
by greybtw
Removed from npm
Blocked by Socket
The script fetches content from a local IP address and echoes a threatening message. This behavior is suspicious and could potentially be part of a malicious activity.
Live on npm for 5 minutes before removal. Socket users were protected even while the package was live.
azure-graphrbac
3.1.4
Removed from npm
Blocked by Socket
Possible typosquat of azure azure-graphrbac is a malicious package that exfiltrates system (Ex - hostname) and project details to external servers.
Live on npm for 28 minutes before removal. Socket users were protected even while the package was live.
bancolombia-design-system
3.1.3
by cbello2332
Removed from npm
Blocked by Socket
The script attempts to connect to a remote server at IP address 192.168.20.38 on port 4444, which is a common technique used for establishing a reverse shell. This poses a significant security risk.
Live on npm for 7 hours and 15 minutes before removal. Socket users were protected even while the package was live.
undici-jey
6.21.2
by jrjs
Live on npm
Blocked by Socket
The code is obfuscated using base64 encoding, which can hide its true purpose. Without further analysis of the decoded WebAssembly module, it's difficult to assess the security risks or potential malicious behavior. The reports are flawed and do not provide any useful information.
azure-graphrbac
6.2.6
Removed from npm
Blocked by Socket
Possible typosquat of [azure](https://socket.dev/npm/package/azure) Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles 'azure' and could be misleading. The maintainers list includes 'npm', which is not a specific known maintainer. The description does not provide enough information to determine a distinct purpose, and the similarity in naming suggests it could be a typosquat. azure-graphrbac is a security-holding package
Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.
fca-milo-mod
0.0.1-security
by ndphuc1a
Removed from npm
Blocked by Socket
The provided code is heavily obfuscated and contains potentially malicious behavior such as dynamic evaluation of code and potential network communication. The presence of obfuscated code, dynamic evaluation, and the potential for unauthorized data transmission raise significant security concerns. It is recommended to thoroughly review the code and validate its integrity.
Live on npm for 1 hour and 53 minutes before removal. Socket users were protected even while the package was live.
pupeteer-recorder
1.0.7
by uw2rzwdfmxfes
Removed from npm
Blocked by Socket
The code poses a significant security risk due to its behavior of downloading and executing remote files without user consent. The heavy obfuscation further raises concerns about its intent, suggesting potential malicious activity.
Live on npm for 5 days, 17 hours and 48 minutes before removal. Socket users were protected even while the package was live.
client-utility-module
1.0.0
by rouk
Removed from npm
Blocked by Socket
The code is malicious, performing unauthorized exfiltration of sensitive system environment variables and hostname to a suspicious external domain. This represents a serious security risk and privacy violation. The code is not obfuscated but clearly designed for covert data theft.
Live on npm for 19 days, 14 hours and 57 minutes before removal. Socket users were protected even while the package was live.
feedback-utils
15.999.999
Removed from npm
Blocked by Socket
The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.
Live on npm for 9 minutes before removal. Socket users were protected even while the package was live.
ea5
6.999.0
by test-qw
Removed from npm
Blocked by Socket
The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.
Live on npm for 11 minutes before removal. Socket users were protected even while the package was live.
cms-vue-boilerplate
9.9.9
by darkry741
Live on npm
Blocked by Socket
The script attempts to send sensitive system information (the contents of '/etc/passwd') to an external server, indicating malicious behavior and a high security risk.
rc-network
1.0.23
Removed from npm
Blocked by Socket
Possible typosquat of [rc-cascader](https://socket.dev/npm/package/rc-cascader) Explanation: The package 'rc-network' is labeled as a security holding package, which is often used to prevent typosquatting. The name 'rc-network' is similar enough to 'rc-cascader' to potentially confuse users, especially since both start with 'rc-'. There is no indication of a distinct purpose, intentional play on words, or known maintainers, making it suspicious.
Live on npm for 1 hour before removal. Socket users were protected even while the package was live.
cgpt_burn_tracker_frontend
1.0.2
by zin_min_phyo
Removed from npm
Blocked by Socket
The code is designed to exfiltrate sensitive system and user information to a remote server, which is indicative of malicious behavior. It poses a significant security risk due to the potential misuse of the exfiltrated data.
Live on npm for 6 hours and 39 minutes before removal. Socket users were protected even while the package was live.
pkg-lumina-test
5.0.0
by avishek18
Removed from npm
Blocked by Socket
The script is trying to make a request to a remote server using the hostname command. This behavior could potentially be used for data exfiltration or to trigger malicious actions on the server.
Live on npm for 1 hour and 25 minutes before removal. Socket users were protected even while the package was live.
atlas-query-editor
0.0.1
by bluehackhds
Removed from npm
Blocked by Socket
The code exhibits malicious behavior by collecting and sending sensitive system and package information to a suspicious domain without user consent. This poses a significant security risk.
Live on npm for 4 hours and 40 minutes before removal. Socket users were protected even while the package was live.
wallet-add-chain
1.0.2
by syt4sh1
Removed from npm
Blocked by Socket
This code snippet is likely malicious. It is designed to extract sensitive system and process data and send them over the network to a certain target URL. It also has the potential to execute shell commands. These behaviors suggest a potential backdoor or information stealing malware.
Live on npm for 10 days, 22 hours and 27 minutes before removal. Socket users were protected even while the package was live.
Socket detects traditional vulnerabilities (CVEs) but goes beyond that to scan the actual code of dependencies for malicious behavior. It proactively detects and blocks 70+ signals of supply chain risk in open source code, for comprehensive protection.
Known malware
Possible typosquat attack
NPM Shrinkwrap
Git dependency
HTTP dependency
Suspicious Stars on GitHub
Protestware or potentially unwanted behavior
Unstable ownership
AI-detected potential malware
Obfuscated code
20 more alerts →
Critical CVE
High CVE
Medium CVE
Low CVE
Bad dependency semver
Wildcard dependency
Unpopular package
Minified code
Socket optimized override available
Deprecated
Unmaintained
Explicitly Unlicensed Item
License Policy Violation
Misc. License Issues
Non-permissive License
Ambiguous License Classifier
Copyleft License
Unidentified License
No License Found
License exception
Socket detects and blocks malicious dependencies, often within just minutes of them being published to public registries, making it the most effective tool for blocking zero-day supply chain attacks.
Socket is built by a team of prolific open source maintainers whose software is downloaded over 1 billion times per month. We understand how to build tools that developers love. But don’t take our word for it.
Nat Friedman
CEO at GitHub
Suz Hinton
Senior Software Engineer at Stripe
heck yes this is awesome!!! Congrats team 🎉👏
Matteo Collina
Node.js maintainer, Fastify lead maintainer
So awesome to see @SocketSecurity launch with a fresh approach! Excited to have supported the team from the early days.
DC Posch
Director of Technology at AppFolio, CTO at Dynasty
This is going to be super important, especially for crypto projects where a compromised dependency results in stolen user assets.
Luis Naranjo
Software Engineer at Microsoft
If software supply chain attacks through npm don't scare the shit out of you, you're not paying close enough attention.
@SocketSecurity sounds like an awesome product. I'll be using socket.dev instead of npmjs.org to browse npm packages going forward
Elena Nadolinski
Founder and CEO at Iron Fish
Huge congrats to @SocketSecurity! 🙌
Literally the only product that proactively detects signs of JS compromised packages.
Joe Previte
Engineering Team Lead at Coder
Congrats to @feross and the @SocketSecurity team on their seed funding! 🚀 It's been a big help for us at @CoderHQ and we appreciate what y'all are doing!
Josh Goldberg
Staff Developer at Codecademy
This is such a great idea & looks fantastic, congrats & good luck @feross + team!
The best security teams in the world use Socket to get visibility into supply chain risk, and to build a security feedback loop into the development process.
Scott Roberts
CISO at UiPath
As a happy Socket customer, I've been impressed with how quickly they are adding value to the product, this move is a great step!
Yan Zhu
Head of Security at Brave, DEFCON, EFF, W3C
glad to hear some of the smartest people i know are working on (npm, etc.) supply chain security finally :). @SocketSecurity
Andrew Peterson
CEO and Co-Founder at Signal Sciences (acq. Fastly)
How do you track the validity of open source software libraries as they get updated? You're prob not. Check out @SocketSecurity and the updated tooling they launched.
Supply chain is a cluster in security as we all know and the tools from Socket are "duh" type tools to be implementing. Check them out and follow Feross Aboukhadijeh to see more updates coming from them in the future.
Zbyszek Tenerowicz
Senior Security Engineer at ConsenSys
socket.dev is getting more appealing by the hour
Devdatta Akhawe
Head of Security at Figma
The @SocketSecurity team is on fire! Amazing progress and I am exciting to see where they go next.
Sebastian Bensusan
Engineer Manager at Stripe
I find it surprising that we don't have _more_ supply chain attacks in software:
Imagine your airplane (the code running) was assembled (deployed) daily, with parts (dependencies) from internet strangers. How long until you get a bad part?
Excited for Socket to prevent this
Adam Baldwin
VP of Security at npm, Red Team at Auth0/Okta
Congrats to everyone at @SocketSecurity ❤️🤘🏻
Nico Waisman
CISO at Lyft
This is an area that I have personally been very focused on. As Nat Friedman said in the 2019 GitHub Universe keynote, Open Source won, and every time you add a new open source project you rely on someone else code and you rely on the people that build it.
This is both exciting and problematic. You are bringing real risk into your organization, and I'm excited to see progress in the industry from OpenSSF scorecards and package analyzers to the company that Feross Aboukhadijeh is building!
Depend on Socket to prevent malicious open source dependencies from infiltrating your app.
Install the Socket GitHub App in just 2 clicks and get protected today.
Block 70+ issues in open source code, including malware, typo-squatting, hidden code, misleading packages, permission creep, and more.
Reduce work by surfacing actionable security information directly in GitHub. Empower developers to make better decisions.
Attackers have taken notice of the opportunity to attack organizations through open source dependencies. Supply chain attacks rose a whopping 700% in the past year, with over 15,000 recorded attacks.
Dec 14, 2023
Hijacked cryptocurrency library adds malware
Widely-used library in cryptocurrency frontend was compromised to include wallet-draining code, following the hijacking of NPM account credentials via phishing.
Jan 06, 2022
Maintainer intentionally adds malware
Rogue maintainer sabotages his own open source package with 100M downloads/month, notably breaking Amazon's AWS SDK.
Nov 15, 2021
npm discovers a platform vulnerability allowing unauthorized publishing of any package
Attackers could publish new versions of any npm package without authorization for multiple years.
Oct 22, 2021
Hijacked package adds cryptominers and password-stealing malware
Multiple packages with 30M downloads/month are hijacked and publish malicious versions directly into the software supply chain.
Nov 26, 2018
Package hijacked adding organization specific backdoors
Obfuscated malware added to a dependency which targeted a single company, went undetected for over a week, and made it into their production build.
Get our latest security research, open source insights, and product updates.
Research
Security News
Malicious Ruby gems typosquat Fastlane plugins to steal Telegram bot tokens, messages, and files, exploiting demand after Vietnam’s Telegram ban.
Research
Security News
Socket uncovered four malicious npm packages that exfiltrate up to 85% of a victim’s Ethereum or BSC wallet using obfuscated JavaScript.
Security News
TC39 advances 9 JavaScript proposals, including Array.fromAsync, Error.isError, and Explicit Resource Management, which are now headed into the ECMAScript spec.
