Secure your dependencies. Ship with confidence.

Malicious code in @qw-app/fonts (npm) Source: ghsa-malware (771852fc5997cf6e52f4535888956d6f803c15c0550991d237720dde289eae82) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in mailchimp-marketing (npm) Source: ghsa-malware (ced47308d68b882837e9c6afc3c2cbcf79aae808a317512ebe2c0ed576c0af5d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 14 hours and 56 minutes before removal. Socket users were protected even while the package was live.

This script exfiltrates the current user's identity by running 'whoami', encoding the result in base64, and sending it to a suspicious domain (example[.]com). Such behavior indicates malicious intent to collect and transmit sensitive information.

The source code demonstrates malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a significant security risk and indicates potential data theft.

Live on npm for 2 hours and 43 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles the legitimate 'azure' package, suggesting it could be a typosquat. The maintainers list includes 'npm', which is not a specific individual or organization, adding to the suspicion. The description does not provide any distinct purpose or functionality, further indicating it might be a placeholder to prevent typosquatting.

Live on npm for 3 hours and 43 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive system information by sending the contents of the /etc/passwd file to a remote server. This behavior is highly suspicious and indicates a potential security risk.

Live on npm for 9 days, 20 hours and 34 minutes before removal. Socket users were protected even while the package was live.

Malicious code in simplebeerservice (npm) Source: ghsa-malware (29c407f683b60dd51dc7c63e032c4f383f986455204d98cfb1d3d95521162c54) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in selinux-policy-languages (npm) Source: ghsa-malware (f659ff7c045e34e255d6f0d30263f037c75a8c93f13a1f85f08b0bac4fd030d6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code is vulnerable to command injection and can be exploited by an attacker to run malicious commands on the system. It poses a high security risk and should be revised to include proper input validation and sanitization.

Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.

Malicious code in jessa-vue-components (npm) Source: ghsa-malware (1feeed80d8641e6b7ff1c8e075720c7bbdd735f9694cd6756702585d66a3a8e1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 7 hours and 9 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @david-lab/sol-lib (npm) Source: ghsa-malware (e0b5dba42ccf786e68c3da9ea3c922e86a77057afd355a7b4534b190ef156e0b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in sticky-tax (npm) Source: ghsa-malware (f92c80c437f457550f2dfb4bf9e163b735bcf6388b77765abb913ac9905e94cc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 28 minutes before removal. Socket users were protected even while the package was live.

Malicious code in msbuild-sdks (npm) Source: ghsa-malware (162783ba3eaa253bb7d50f7d65ea470a0f477435f6755c200252a0d5649d523d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 12 hours and 26 minutes before removal. Socket users were protected even while the package was live.

Malicious code in pm-web-mapp-shared (npm) Source: ghsa-malware (6ac03172ff2d9c4945a67995634a88ef483ae3bdb87b941fb17ad92ca8b60408) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 11 hours and 7 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 3 hours and 14 minutes before removal. Socket users were protected even while the package was live.

Malicious code in assets-common (npm) Source: ghsa-malware (05a4834f0fdf1d1525506291927bb9813a912ee5ac8f61ddacbb11e4b2932b23) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 8 hours and 9 minutes before removal. Socket users were protected even while the package was live.

Malicious code in aae-stream (npm) Source: ghsa-malware (36e873811e988aacce5a1b80244d157a56da0753c128f1d7581878716119c230) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 22 minutes before removal. Socket users were protected even while the package was live.

The script collects a wide range of information from the user's system, including OS details, network interfaces, and SSH files, and sends it to a remote server via DNS queries.

Malicious code in itsmerobottt (npm) Source: ghsa-malware (05535a64865868032103d2f29b1a3c0ba770470a0f8b421233cc5a84cffadfcb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 hour and 34 minutes before removal. Socket users were protected even while the package was live.

The code fragment appears to send tracking data, including sensitive system information, to a suspicious remote server. This behavior raises concerns about privacy and potential data leakage. The code does not handle errors during the request, which could result in unhandled exceptions. Based on these findings, the code poses a moderate security risk.

Live on npm for 7 hours and 52 minutes before removal. Socket users were protected even while the package was live.

Malicious code in internallib_v900 (npm) Source: ghsa-malware (4b444ce60e2348e602dc655ad88d7db0e56e3c5f7b2678bfa26154dbab981222) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 12 hours and 25 minutes before removal. Socket users were protected even while the package was live.

This code exhibits malicious behavior by collecting sensitive system information (OS type, username, current working directory, hostname, and IP addresses), encoding this data in base64, and sending it to a remote server (http://149[.]104[.]26[.]89/cmd.dat). It also attempts to download and execute a binary payload from the same server, which could lead to further compromise. The code includes environment checks to determine if it's running in a sandbox, suggesting an attempt to evade detection. After execution, it attempts to delete files to cover its tracks. The code is heavily obfuscated to make analysis difficult.

Live on npm for 4 days, 1 hour and 21 minutes before removal. Socket users were protected even while the package was live.

Malicious code in nqbcksuatvlgpkfy (npm) Source: ghsa-malware (462f43c40286edf3abdbd7fcfb8ef7e6ddc6e10f521c0ebb863a5384014f74c2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in package-show (npm) Source: ghsa-malware (443ae5878aeef65b3fcccbbd8aabfd6f07127a425a1715c4d20269b72f288b96) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This file sets up a malicious backdoor by connecting to a database for sensitive information, writing credential-like data to configuration files, and executing a command that is copied to the clipboard. It includes explicit references to 'backdoor' functionality, uses insecure random ID generation, and may facilitate unauthorized remote access. No known domain or IP addresses were identified, but any domain or IP usage for malicious activities should be treated as example[.]com. The backdoor code poses a high security risk due to its ability to exfiltrate data and run additional commands.

Malicious code in @qw-app/fonts (npm) Source: ghsa-malware (771852fc5997cf6e52f4535888956d6f803c15c0550991d237720dde289eae82) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in mailchimp-marketing (npm) Source: ghsa-malware (ced47308d68b882837e9c6afc3c2cbcf79aae808a317512ebe2c0ed576c0af5d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 14 hours and 56 minutes before removal. Socket users were protected even while the package was live.

This script exfiltrates the current user's identity by running 'whoami', encoding the result in base64, and sending it to a suspicious domain (example[.]com). Such behavior indicates malicious intent to collect and transmit sensitive information.

The source code demonstrates malicious behavior by collecting and transmitting sensitive system information to an external server without user consent. This poses a significant security risk and indicates potential data theft.

Live on npm for 2 hours and 43 minutes before removal. Socket users were protected even while the package was live.

Possible typosquat of azure - Explanation: The package 'azure-graphrbac' is labeled as a 'security holding package', which often indicates a placeholder to prevent typosquatting. The name 'azure-graphrbac' closely resembles the legitimate 'azure' package, suggesting it could be a typosquat. The maintainers list includes 'npm', which is not a specific individual or organization, adding to the suspicion. The description does not provide any distinct purpose or functionality, further indicating it might be a placeholder to prevent typosquatting.

Live on npm for 3 hours and 43 minutes before removal. Socket users were protected even while the package was live.

This script is attempting to exfiltrate sensitive system information by sending the contents of the /etc/passwd file to a remote server. This behavior is highly suspicious and indicates a potential security risk.

Live on npm for 9 days, 20 hours and 34 minutes before removal. Socket users were protected even while the package was live.

Malicious code in simplebeerservice (npm) Source: ghsa-malware (29c407f683b60dd51dc7c63e032c4f383f986455204d98cfb1d3d95521162c54) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in selinux-policy-languages (npm) Source: ghsa-malware (f659ff7c045e34e255d6f0d30263f037c75a8c93f13a1f85f08b0bac4fd030d6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The code is vulnerable to command injection and can be exploited by an attacker to run malicious commands on the system. It poses a high security risk and should be revised to include proper input validation and sanitization.

Live on npm for 13 minutes before removal. Socket users were protected even while the package was live.

Malicious code in jessa-vue-components (npm) Source: ghsa-malware (1feeed80d8641e6b7ff1c8e075720c7bbdd735f9694cd6756702585d66a3a8e1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 7 hours and 9 minutes before removal. Socket users were protected even while the package was live.

Malicious code in @david-lab/sol-lib (npm) Source: ghsa-malware (e0b5dba42ccf786e68c3da9ea3c922e86a77057afd355a7b4534b190ef156e0b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in sticky-tax (npm) Source: ghsa-malware (f92c80c437f457550f2dfb4bf9e163b735bcf6388b77765abb913ac9905e94cc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 4 hours and 28 minutes before removal. Socket users were protected even while the package was live.

Malicious code in msbuild-sdks (npm) Source: ghsa-malware (162783ba3eaa253bb7d50f7d65ea470a0f477435f6755c200252a0d5649d523d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 12 hours and 26 minutes before removal. Socket users were protected even while the package was live.

Malicious code in pm-web-mapp-shared (npm) Source: ghsa-malware (6ac03172ff2d9c4945a67995634a88ef483ae3bdb87b941fb17ad92ca8b60408) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 11 hours and 7 minutes before removal. Socket users were protected even while the package was live.

Malicious code in azure-graphrbac (npm) Source: ghsa-malware (8753478507375846584df851f88ad72637d64beb4e8e6a5ffdaa19b39440e7fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 3 hours and 14 minutes before removal. Socket users were protected even while the package was live.

Malicious code in assets-common (npm) Source: ghsa-malware (05a4834f0fdf1d1525506291927bb9813a912ee5ac8f61ddacbb11e4b2932b23) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 8 hours and 9 minutes before removal. Socket users were protected even while the package was live.

Malicious code in aae-stream (npm) Source: ghsa-malware (36e873811e988aacce5a1b80244d157a56da0753c128f1d7581878716119c230) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 22 minutes before removal. Socket users were protected even while the package was live.

The script collects a wide range of information from the user's system, including OS details, network interfaces, and SSH files, and sends it to a remote server via DNS queries.

Malicious code in itsmerobottt (npm) Source: ghsa-malware (05535a64865868032103d2f29b1a3c0ba770470a0f8b421233cc5a84cffadfcb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 1 hour and 34 minutes before removal. Socket users were protected even while the package was live.

The code fragment appears to send tracking data, including sensitive system information, to a suspicious remote server. This behavior raises concerns about privacy and potential data leakage. The code does not handle errors during the request, which could result in unhandled exceptions. Based on these findings, the code poses a moderate security risk.

Live on npm for 7 hours and 52 minutes before removal. Socket users were protected even while the package was live.

Malicious code in internallib_v900 (npm) Source: ghsa-malware (4b444ce60e2348e602dc655ad88d7db0e56e3c5f7b2678bfa26154dbab981222) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Live on npm for 12 hours and 25 minutes before removal. Socket users were protected even while the package was live.

This code exhibits malicious behavior by collecting sensitive system information (OS type, username, current working directory, hostname, and IP addresses), encoding this data in base64, and sending it to a remote server (http://149[.]104[.]26[.]89/cmd.dat). It also attempts to download and execute a binary payload from the same server, which could lead to further compromise. The code includes environment checks to determine if it's running in a sandbox, suggesting an attempt to evade detection. After execution, it attempts to delete files to cover its tracks. The code is heavily obfuscated to make analysis difficult.

Live on npm for 4 days, 1 hour and 21 minutes before removal. Socket users were protected even while the package was live.

Malicious code in nqbcksuatvlgpkfy (npm) Source: ghsa-malware (462f43c40286edf3abdbd7fcfb8ef7e6ddc6e10f521c0ebb863a5384014f74c2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in package-show (npm) Source: ghsa-malware (443ae5878aeef65b3fcccbbd8aabfd6f07127a425a1715c4d20269b72f288b96) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This file sets up a malicious backdoor by connecting to a database for sensitive information, writing credential-like data to configuration files, and executing a command that is copied to the clipboard. It includes explicit references to 'backdoor' functionality, uses insecure random ID generation, and may facilitate unauthorized remote access. No known domain or IP addresses were identified, but any domain or IP usage for malicious activities should be treated as example[.]com. The backdoor code poses a high security risk due to its ability to exfiltrate data and run additional commands.