Secure your dependencies. Ship with confidence.

The code collects sensitive user and system information and sends it to an external server, likely for data exfiltration. This behavior is indicative of malicious intent and poses a significant security risk.

Live on npm for 1 hour and 2 minutes before removal. Socket users were protected even while the package was live.

The code is malicious, exfiltrating sensitive system data to a remote server. It poses a significant security risk.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

This code poses a serious security risk and should not be used.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

The script is not necessarily malicious, but it does involve dubious practices like automated publishing of npm packages and programmatically updating a WordPress site. It is also insecure due to the hardcoding of credentials and the potential misuse of automated npm package publishing.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

The code is designed for malicious purposes, performing system reconnaissance and data exfiltration to an attacker-controlled server. It employs obfuscation techniques such as hex encoding and DNS lookups for data transmission, and targets sensitive files ('/etc/hosts'), confirming its intent as malware.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

Malicious code in purple_team_midway_cenario_1 (npm) Source: ghsa-malware (e78d943ca5c3b25d23aef36ac8b32d6df51c114bcae3b18f06ec806927f3bab0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code collects sensitive user and system data and sends it to a remote server, posing a significant privacy risk. It is also not handling any potential errors during the request. It seems to serve no useful purpose from the user's perspective and can be considered as a potential tracking or data harvesting script.

Live on npm for 33 minutes before removal. Socket users were protected even while the package was live.

The script collects sensitive information about the system and sends it to a remote server, which is highly suspicious and malicious in nature.

Live on npm for 3 days, 19 hours and 51 minutes before removal. Socket users were protected even while the package was live.

The code contains obfuscated and suspicious sections that could potentially be used for malicious activities. The complex and convoluted nature of the code makes it difficult to determine the full extent of any malicious behavior. Caution is advised when using this code.

Live on npm for 41 minutes before removal. Socket users were protected even while the package was live.

The source code contains a potentially dangerous function 'evilJS' that may lead to arbitrary code execution, but there is no direct evidence of malicious intent such as data exfiltration, cryptomining, or system damage. However, the use of 'Function' constructor for dynamic script execution is a significant security risk.

Live on npm for 1 day, 4 hours and 56 minutes before removal. Socket users were protected even while the package was live.

The code is performing actions typical of malicious software, such as collecting and transmitting sensitive system information to an external server. This poses a significant security risk.

Live on npm for 2 hours and 33 minutes before removal. Socket users were protected even while the package was live.

The code imports multiple modules with unusual naming conventions and calls their `functame` methods without any documentation or explanation. This is suspicious and suggests possible obfuscation or unconventional practices. However, there is no direct evidence of malicious behavior within the provided code fragment. Further investigation of the imported modules is necessary to make a more informed judgment.

Live on npm for 57 days, 13 hours and 8 minutes before removal. Socket users were protected even while the package was live.

The script collects information like hostname, username, and public IP address and sends it to a remote server using a DNS query.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

Malicious code in workarea-gift-cards (RubyGems)

The code appears to perform potentially malicious actions, such as executing commands obtained from a DNS TXT record and making network requests. It also includes hard-coded credentials and server information. Further investigation is required to determine the purpose and legitimacy of these actions.

Live on npm for 32 days, 7 hours and 19 minutes before removal. Socket users were protected even while the package was live.

The script shows clear signs of malicious intent or could be used in harmful ways, primarily through automated spamming or potential unauthorized content manipulation. The hard-coded credentials and the automated, hidden nature of operations (like file deletion and infinite loops) suggest a high security risk.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code is clearly designed to exfiltrate sensitive system information to a remote server without user consent. This behavior is malicious and poses a significant security risk.

Live on npm for 4 hours and 8 minutes before removal. Socket users were protected even while the package was live.

The code is designed to collect and exfiltrate sensitive system and user data to a suspicious domain, indicating malicious intent. The high malware and security risk scores reflect the serious nature of this behavior.

Live on npm for 10 days, 4 hours and 6 minutes before removal. Socket users were protected even while the package was live.

The code exhibits behavior consistent with malware by collecting and transmitting sensitive system data to an external server without user consent. This poses a significant security risk.

Live on npm for 9 days, 10 hours and 35 minutes before removal. Socket users were protected even while the package was live.

The code is highly malicious, establishing a reverse shell and making a suspicious network connection. These actions pose significant security risks, including remote code execution and potential data theft.

Live on npm for 1 hour and 17 minutes before removal. Socket users were protected even while the package was live.

The code is attempting to exfiltrate environment variables to a suspicious host, posing a significant data leakage risk. The code exhibits obfuscated elements and clear malicious behavior, making it highly risky and likely malicious.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

The code is clearly exfiltrating sensitive system information (hostname, username, current working directory, and network interfaces) to a remote server using the ping command. This behavior is indicative of malicious activity and poses a serious security risk.

Live on npm for 1 hour and 13 minutes before removal. Socket users were protected even while the package was live.

The script collects information like package name, directory path, home directory, hostname, username, DNS servers, and package details, and sends it to a remote server.

Live on npm for 361 days, 5 hours and 12 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code collects sensitive user and system information and sends it to an external server, likely for data exfiltration. This behavior is indicative of malicious intent and poses a significant security risk.

Live on npm for 1 hour and 2 minutes before removal. Socket users were protected even while the package was live.

The code is malicious, exfiltrating sensitive system data to a remote server. It poses a significant security risk.

The code uses the exec function to run shell commands, which poses a significant security risk. It could potentially execute malicious code if the input to exec is manipulated. Redirecting output to /dev/null to hide execution details is suspicious.

This code poses a serious security risk and should not be used.

Live on npm for 6 minutes before removal. Socket users were protected even while the package was live.

The script is not necessarily malicious, but it does involve dubious practices like automated publishing of npm packages and programmatically updating a WordPress site. It is also insecure due to the hardcoding of credentials and the potential misuse of automated npm package publishing.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

The code is designed for malicious purposes, performing system reconnaissance and data exfiltration to an attacker-controlled server. It employs obfuscation techniques such as hex encoding and DNS lookups for data transmission, and targets sensitive files ('/etc/hosts'), confirming its intent as malware.

Live on npm for 2 minutes before removal. Socket users were protected even while the package was live.

Malicious code in purple_team_midway_cenario_1 (npm) Source: ghsa-malware (e78d943ca5c3b25d23aef36ac8b32d6df51c114bcae3b18f06ec806927f3bab0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code collects sensitive user and system data and sends it to a remote server, posing a significant privacy risk. It is also not handling any potential errors during the request. It seems to serve no useful purpose from the user's perspective and can be considered as a potential tracking or data harvesting script.

Live on npm for 33 minutes before removal. Socket users were protected even while the package was live.

The script collects sensitive information about the system and sends it to a remote server, which is highly suspicious and malicious in nature.

Live on npm for 3 days, 19 hours and 51 minutes before removal. Socket users were protected even while the package was live.

The code contains obfuscated and suspicious sections that could potentially be used for malicious activities. The complex and convoluted nature of the code makes it difficult to determine the full extent of any malicious behavior. Caution is advised when using this code.

Live on npm for 41 minutes before removal. Socket users were protected even while the package was live.

The source code contains a potentially dangerous function 'evilJS' that may lead to arbitrary code execution, but there is no direct evidence of malicious intent such as data exfiltration, cryptomining, or system damage. However, the use of 'Function' constructor for dynamic script execution is a significant security risk.

Live on npm for 1 day, 4 hours and 56 minutes before removal. Socket users were protected even while the package was live.

The code is performing actions typical of malicious software, such as collecting and transmitting sensitive system information to an external server. This poses a significant security risk.

Live on npm for 2 hours and 33 minutes before removal. Socket users were protected even while the package was live.

The code imports multiple modules with unusual naming conventions and calls their `functame` methods without any documentation or explanation. This is suspicious and suggests possible obfuscation or unconventional practices. However, there is no direct evidence of malicious behavior within the provided code fragment. Further investigation of the imported modules is necessary to make a more informed judgment.

Live on npm for 57 days, 13 hours and 8 minutes before removal. Socket users were protected even while the package was live.

The script collects information like hostname, username, and public IP address and sends it to a remote server using a DNS query.

Live on npm for 3 minutes before removal. Socket users were protected even while the package was live.

Malicious code in workarea-gift-cards (RubyGems)

The code appears to perform potentially malicious actions, such as executing commands obtained from a DNS TXT record and making network requests. It also includes hard-coded credentials and server information. Further investigation is required to determine the purpose and legitimacy of these actions.

Live on npm for 32 days, 7 hours and 19 minutes before removal. Socket users were protected even while the package was live.

The script shows clear signs of malicious intent or could be used in harmful ways, primarily through automated spamming or potential unauthorized content manipulation. The hard-coded credentials and the automated, hidden nature of operations (like file deletion and infinite loops) suggest a high security risk.

Live on npm for 1 minute before removal. Socket users were protected even while the package was live.

The code is clearly designed to exfiltrate sensitive system information to a remote server without user consent. This behavior is malicious and poses a significant security risk.

Live on npm for 4 hours and 8 minutes before removal. Socket users were protected even while the package was live.

The code is designed to collect and exfiltrate sensitive system and user data to a suspicious domain, indicating malicious intent. The high malware and security risk scores reflect the serious nature of this behavior.

Live on npm for 10 days, 4 hours and 6 minutes before removal. Socket users were protected even while the package was live.

The code exhibits behavior consistent with malware by collecting and transmitting sensitive system data to an external server without user consent. This poses a significant security risk.

Live on npm for 9 days, 10 hours and 35 minutes before removal. Socket users were protected even while the package was live.

The code is highly malicious, establishing a reverse shell and making a suspicious network connection. These actions pose significant security risks, including remote code execution and potential data theft.

Live on npm for 1 hour and 17 minutes before removal. Socket users were protected even while the package was live.

The code is attempting to exfiltrate environment variables to a suspicious host, posing a significant data leakage risk. The code exhibits obfuscated elements and clear malicious behavior, making it highly risky and likely malicious.

Live on npm for 20 minutes before removal. Socket users were protected even while the package was live.

The code is clearly exfiltrating sensitive system information (hostname, username, current working directory, and network interfaces) to a remote server using the ping command. This behavior is indicative of malicious activity and poses a serious security risk.

Live on npm for 1 hour and 13 minutes before removal. Socket users were protected even while the package was live.

The script collects information like package name, directory path, home directory, hostname, username, DNS servers, and package details, and sends it to a remote server.

Live on npm for 361 days, 5 hours and 12 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @zitterorg/laudantium-rerum (npm) Source: ghsa-malware (e45ff91dd83cc149d7abc8c6fb2c74e3509aa341e23c72cfac0a34868a4e2637) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.