Secure your dependencies. Ship with confidence.

The code implements remote dynamic class loading and execution via network fetch and reflection. While such a mechanism can be legitimate for plugin ecosystems, it introduces a clear remote-code-execution risk in supply-chain contexts. It should be treated as high-risk for unauthenticated payload loading and require strong controls: TLS, payload signing/verification, strict allowlists, sandboxing, and minimum privileges. If kept, ensure robust auditing and runtime protections.

This SQLite database file contains embedded explicit adult content and torrent distribution infrastructure instead of legitimate data. The file includes extensive HTML fragments with pornographic video metadata, download links to torrent files, and suspicious redirect URLs. Key malicious domains identified include rmdown[.]com, redircdn[.]com, 97p[.]org, qpic[.]ws, imgbox[.]com, and various other image hosting services. The content contains hash values for torrent files, BitTorrent magnet links, and obfuscated download URLs using multiple redirect layers to mask the true destinations. This represents a supply chain attack where adult content distribution infrastructure has been embedded within what appears to be a standard database file, potentially exposing users to inappropriate content and malicious download sites when accessed.

This module contains a critical vulnerability: unconstrained eval() of attacker-controlled 'input.expr' with access to local variables (including a formatted request object). This yields remote code execution and potential data exfiltration. The code likely represents an insecure design/bug rather than intentionally malicious code, but it must be remediated before handling untrusted inputs. Also fix the apparent syntax error in getAttr.

`lotusbail` is a malicious npm package that masquerades as a WhatsApp Web API library by forking legitimate Baileys-based code and preserving working messaging functionality. In addition to normal API behavior, it inserts a wrapper around the WhatsApp WebSocket client so that all traffic passing through the library is duplicated for collection. Reported data theft includes WhatsApp authentication tokens and session keys, full message content (sent/received and historical), contact lists (including phone numbers), and transferred media/files. The package also attempts to establish persistent unauthorized access by hijacking the WhatsApp device-linking (“pairing”) workflow using a hardcoded pairing code, effectively linking an attacker-controlled device to the victim’s account; removing the npm dependency does not automatically remove the linked device. To hinder detection, the exfiltration endpoint is hidden behind multiple obfuscation layers, collected data is encrypted (including a custom RSA implementation), and the code includes anti-debugging traps designed to disrupt analysis.

The file contains obfuscated malicious code that uses base64 encoding and zlib compression to hide its functionality. After deobfuscation, the code is executed using Python's exec() function, enabling arbitrary code execution. The deliberate obfuscation combined with dynamic code execution and attempts to delete evidence (removing variables after execution) demonstrates clear malicious intent.

This module intentionally conceals executable Python code and runs it immediately on import using exec. That is a strong red flag for supply-chain abuse: it prevents casual inspection of behavior and allows arbitrary actions at runtime. Treat the file as untrusted until the decompressed payload has been inspected in a controlled environment. Do not import this module in production or sensitive contexts.

The SweetAlert2 library code is mostly benign and serves as a UI modal dialog tool. However, it contains a suspicious and potentially malicious snippet that targets Russian users on certain domains to play an unsolicited audio prank, disabling pointer events and potentially disrupting user interaction. This behavior is unexpected and should be considered a moderate security risk and potential malware. The rest of the code shows no signs of malicious intent. The provided reports were invalid and unhelpful. Users should be cautious about this version of the library due to the embedded prank behavior.

This code poses a serious security risk and should not be used.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code is designed to exfiltrate sensitive system information (hostname, username, current working directory, and network interfaces) to an external server (pingb.in). This behavior is indicative of malicious activity, specifically data exfiltration. The code is not heavily obfuscated but uses base64 encoding to mildly obfuscate the data. The risk posed by this code is high due to the nature of the exfiltrated information.

Live on npm for 3 hours and 15 minutes before removal. Socket users were protected even while the package was live.

The source code contains suspicious and potentially malicious behavior by uploading arbitrary local files and detailed metadata to a remote server using hardcoded authentication tokens and device identifiers. This constitutes a significant security risk involving unauthorized data exfiltration and privacy violation. Although no direct malware payload like reverse shells or destructive actions are present, the code should be considered high risk and likely malicious due to its data exfiltration capabilities and lack of user transparency.

The code is designed to send potentially sensitive information to a remote server, which poses a significant privacy risk. The tracking of system data, particularly without user consent, suggests malicious behavior. Therefore, caution is advised in using this code.

This JavaScript file uses eval(atob(...)) to decode and execute a hidden Base64 payload at runtime. The decoded code probes the browser environment—accessing window, document, navigator, cookies and localStorage—then packages dates, user identifiers and other context data and sends it to an external endpoint at https[:]//webhook[.]site/31958b1c-1065-491c-b7aa-10507741174. Heavy obfuscation, dynamic code execution and a hard-coded remote server demonstrate a backdoor or data-exfiltration malware with a high supply-chain risk.

This module is highly risky in a supply-chain context because it accepts raw Python source and builds/runs it in Docker (including a remote Docker daemon) with little or no validation or sandboxing. I found no explicit hardcoded backdoors, credential leaks, or obfuscated/malicious payloads in the fragment itself, but the functionality enables remote execution of arbitrary code (and thus could be abused). The code also contains several bugs and incomplete/incorrect parts (bad Dockerfile text, syntax error in generated main.py, missing build/run methods), suggesting it is incomplete. Treat usage as high-risk: only feed trusted code, and never point to an untrusted Docker daemon.

This file implements Windows RPC handlers for a remote implant/agent (Sliver). It exposes numerous high-risk capabilities: arbitrary command/process execution, DLL spawning and process migration, in-memory assembly execution, token impersonation/creation, registry and service manipulation, and process memory dumping. The handlers accept controller-supplied protobuf messages and map them directly to privileged operations without validation in this module. This is functionality consistent with a backdoor/implant and is dangerous if received from an unauthorized source. The code itself is readable (not obfuscated) and contains no hardcoded secrets in this file, but its behavior is intentionally malicious/dual-use.

The code is highly suspicious due to its obfuscation, collection of environment variables, and transmission of this data to an external server. This behavior is indicative of data exfiltration, posing a significant security risk.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

This file defines a Segment destination named 'Trackey' but hard-codes its HTTP sink to https://eo493p73oqjeket[.]m[.]pipedream[.]net/public-api/integrations/segment/webhook. All incoming event fields (userId, event, messageId, timestamp, properties, groupId, traits) are forwarded verbatim in a JSON POST, and the user-supplied API key is sent in an 'api-key' header. Because the endpoint is an unrelated pipedream[.]net collector rather than an official Trackey API, this constitutes intentional data exfiltration and credential leakage. Do not deploy this connector with real secrets or PII until the endpoint and maintainer intent are fully verified; rotate any exposed keys immediately.

The code collects sensitive system information without user consent and sends it to an external server via a Discord webhook. The code gathers data such as the user's internal IP address, external IP address (obtained via an HTTP request to 'https[:]//ipinfo[.]io/json'), hostname, username, home directory, DNS server information, and package details from 'package.json'. This information is then formatted into a JSON object and transmitted to a hardcoded Discord webhook URL ('https[:]//discord[.]com/api/webhooks/...'). This behavior constitutes unauthorized data exfiltration and poses significant privacy and security risks.

Live on npm for 18 days, 23 hours and 10 minutes before removal. Socket users were protected even while the package was live.

This file implements a malicious network flood and local-file transmission tool. It will create massive concurrent outbound TCP connections and stream a local file to the configured target — actions consistent with denial-of-service and data-exfiltration malware. The code is not obfuscated but is intentionally destructive/abusive. Do not run this code. Investigate any instances where this file appears in repositories or systems and treat as malicious/artifact of abuse. The script also contains a syntax error that may prevent execution as provided.

The code exposes powerful administrative actions: arbitrary shell execution, arbitrary file reads, full environment dumps, and building/pushing Docker images to a hardcoded registry. These are not obfuscated but are high-risk capabilities that can be abused for data exfiltration, remote code execution, and supply-chain leakage if the superuser authentication is compromised or misconfigured. The presence of a hardcoded remote image name for docker push is suspicious for unintended outbound artifact exfiltration. Recommendation: avoid including these endpoints in public packages or ensure strict, auditable authentication and input validation; remove hardcoded push targets and avoid returning full environment variables or arbitrary file contents.

The setup.py file itself contains only benign packaging metadata and performs no runtime operations. However, the description explicitly states the package is for 'malware building', which is a significant red flag that changes the threat model: the package distribution likely contains dual-use or malicious code. This file alone cannot confirm malware, but it warrants treating the package as high-risk and performing a full code review of package modules before any installation or use.

This source code contains clear malicious behavior indicative of a supply chain attack or malware. It exfiltrates sensitive system data (/etc/passwd) to an external attacker-controlled domain using a shell command executed from Node.js. The risk is critical, with high probability of malware intent and significant security risk. The code is not obfuscated but uses suspicious domain naming to avoid detection. It should be considered dangerous and avoided.

Live on npm for 3 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The code sends sensitive credentials from environment variables over an unencrypted HTTP connection to an external API service at api[.]sqhyw[.]net:90. It authenticates using username/password from the YEZI_USER environment variable, retrieves access tokens, and automates the process of obtaining mobile phone numbers and SMS verification codes. This behavior poses significant supply chain security risks through: (1) leakage of environment variable credentials over unencrypted HTTP, (2) interaction with a suspicious external domain on a non-standard port, (3) logging of potentially sensitive API responses including tokens and SMS codes, and (4) facilitation of SMS verification bypass which could enable fraudulent account creation or spam activities. The code continuously polls the external API for up to 120 seconds to retrieve SMS codes, creating additional operational risks. While not containing traditional malware payloads, the credential exfiltration and suspicious external communication patterns justify classification as malware due to the significant security risks posed to systems that deploy this code.

This file is an explicit DDoS/flooding tool. It reads a proxy list and command-line inputs to construct and send massive HTTP/HTTP2 requests through CONNECT proxies, spoofing headers and randomizing parameters. The code intentionally disables error reporting and TLS verification, forks many worker processes, and repeatedly issues requests at high rate. This is malicious in intent for unauthorized traffic flooding and should not be used against targets without explicit permission. Do not run this code in environments you do not control; inclusion in a package would be a high-risk supply-chain issue.

This code performs covert data exfiltration: it enumerates spreadsheet files in a directory, reads their contents into pandas DataFrames, serializes them to JSON, and sends them over an unencrypted TCP connection to a hardcoded remote host (35.189.183.226:9999). Variable obfuscation, hardcoded network target, custom framing markers, and unnecessary imports (itchat for version fingerprinting) strongly indicate intentional malicious behavior. Treat this module as malicious, do not run it, and investigate any systems where it executed for data leakage.

The code implements remote dynamic class loading and execution via network fetch and reflection. While such a mechanism can be legitimate for plugin ecosystems, it introduces a clear remote-code-execution risk in supply-chain contexts. It should be treated as high-risk for unauthenticated payload loading and require strong controls: TLS, payload signing/verification, strict allowlists, sandboxing, and minimum privileges. If kept, ensure robust auditing and runtime protections.

This SQLite database file contains embedded explicit adult content and torrent distribution infrastructure instead of legitimate data. The file includes extensive HTML fragments with pornographic video metadata, download links to torrent files, and suspicious redirect URLs. Key malicious domains identified include rmdown[.]com, redircdn[.]com, 97p[.]org, qpic[.]ws, imgbox[.]com, and various other image hosting services. The content contains hash values for torrent files, BitTorrent magnet links, and obfuscated download URLs using multiple redirect layers to mask the true destinations. This represents a supply chain attack where adult content distribution infrastructure has been embedded within what appears to be a standard database file, potentially exposing users to inappropriate content and malicious download sites when accessed.

This module contains a critical vulnerability: unconstrained eval() of attacker-controlled 'input.expr' with access to local variables (including a formatted request object). This yields remote code execution and potential data exfiltration. The code likely represents an insecure design/bug rather than intentionally malicious code, but it must be remediated before handling untrusted inputs. Also fix the apparent syntax error in getAttr.

`lotusbail` is a malicious npm package that masquerades as a WhatsApp Web API library by forking legitimate Baileys-based code and preserving working messaging functionality. In addition to normal API behavior, it inserts a wrapper around the WhatsApp WebSocket client so that all traffic passing through the library is duplicated for collection. Reported data theft includes WhatsApp authentication tokens and session keys, full message content (sent/received and historical), contact lists (including phone numbers), and transferred media/files. The package also attempts to establish persistent unauthorized access by hijacking the WhatsApp device-linking (“pairing”) workflow using a hardcoded pairing code, effectively linking an attacker-controlled device to the victim’s account; removing the npm dependency does not automatically remove the linked device. To hinder detection, the exfiltration endpoint is hidden behind multiple obfuscation layers, collected data is encrypted (including a custom RSA implementation), and the code includes anti-debugging traps designed to disrupt analysis.

The file contains obfuscated malicious code that uses base64 encoding and zlib compression to hide its functionality. After deobfuscation, the code is executed using Python's exec() function, enabling arbitrary code execution. The deliberate obfuscation combined with dynamic code execution and attempts to delete evidence (removing variables after execution) demonstrates clear malicious intent.

This module intentionally conceals executable Python code and runs it immediately on import using exec. That is a strong red flag for supply-chain abuse: it prevents casual inspection of behavior and allows arbitrary actions at runtime. Treat the file as untrusted until the decompressed payload has been inspected in a controlled environment. Do not import this module in production or sensitive contexts.

The SweetAlert2 library code is mostly benign and serves as a UI modal dialog tool. However, it contains a suspicious and potentially malicious snippet that targets Russian users on certain domains to play an unsolicited audio prank, disabling pointer events and potentially disrupting user interaction. This behavior is unexpected and should be considered a moderate security risk and potential malware. The rest of the code shows no signs of malicious intent. The provided reports were invalid and unhelpful. Users should be cautious about this version of the library due to the embedded prank behavior.

This code poses a serious security risk and should not be used.

Live on npm for 4 minutes before removal. Socket users were protected even while the package was live.

The code is designed to exfiltrate sensitive system information (hostname, username, current working directory, and network interfaces) to an external server (pingb.in). This behavior is indicative of malicious activity, specifically data exfiltration. The code is not heavily obfuscated but uses base64 encoding to mildly obfuscate the data. The risk posed by this code is high due to the nature of the exfiltrated information.

Live on npm for 3 hours and 15 minutes before removal. Socket users were protected even while the package was live.

The source code contains suspicious and potentially malicious behavior by uploading arbitrary local files and detailed metadata to a remote server using hardcoded authentication tokens and device identifiers. This constitutes a significant security risk involving unauthorized data exfiltration and privacy violation. Although no direct malware payload like reverse shells or destructive actions are present, the code should be considered high risk and likely malicious due to its data exfiltration capabilities and lack of user transparency.

The code is designed to send potentially sensitive information to a remote server, which poses a significant privacy risk. The tracking of system data, particularly without user consent, suggests malicious behavior. Therefore, caution is advised in using this code.

This JavaScript file uses eval(atob(...)) to decode and execute a hidden Base64 payload at runtime. The decoded code probes the browser environment—accessing window, document, navigator, cookies and localStorage—then packages dates, user identifiers and other context data and sends it to an external endpoint at https[:]//webhook[.]site/31958b1c-1065-491c-b7aa-10507741174. Heavy obfuscation, dynamic code execution and a hard-coded remote server demonstrate a backdoor or data-exfiltration malware with a high supply-chain risk.

This module is highly risky in a supply-chain context because it accepts raw Python source and builds/runs it in Docker (including a remote Docker daemon) with little or no validation or sandboxing. I found no explicit hardcoded backdoors, credential leaks, or obfuscated/malicious payloads in the fragment itself, but the functionality enables remote execution of arbitrary code (and thus could be abused). The code also contains several bugs and incomplete/incorrect parts (bad Dockerfile text, syntax error in generated main.py, missing build/run methods), suggesting it is incomplete. Treat usage as high-risk: only feed trusted code, and never point to an untrusted Docker daemon.

This file implements Windows RPC handlers for a remote implant/agent (Sliver). It exposes numerous high-risk capabilities: arbitrary command/process execution, DLL spawning and process migration, in-memory assembly execution, token impersonation/creation, registry and service manipulation, and process memory dumping. The handlers accept controller-supplied protobuf messages and map them directly to privileged operations without validation in this module. This is functionality consistent with a backdoor/implant and is dangerous if received from an unauthorized source. The code itself is readable (not obfuscated) and contains no hardcoded secrets in this file, but its behavior is intentionally malicious/dual-use.

The code is highly suspicious due to its obfuscation, collection of environment variables, and transmission of this data to an external server. This behavior is indicative of data exfiltration, posing a significant security risk.

Live on npm for 19 minutes before removal. Socket users were protected even while the package was live.

This file defines a Segment destination named 'Trackey' but hard-codes its HTTP sink to https://eo493p73oqjeket[.]m[.]pipedream[.]net/public-api/integrations/segment/webhook. All incoming event fields (userId, event, messageId, timestamp, properties, groupId, traits) are forwarded verbatim in a JSON POST, and the user-supplied API key is sent in an 'api-key' header. Because the endpoint is an unrelated pipedream[.]net collector rather than an official Trackey API, this constitutes intentional data exfiltration and credential leakage. Do not deploy this connector with real secrets or PII until the endpoint and maintainer intent are fully verified; rotate any exposed keys immediately.

The code collects sensitive system information without user consent and sends it to an external server via a Discord webhook. The code gathers data such as the user's internal IP address, external IP address (obtained via an HTTP request to 'https[:]//ipinfo[.]io/json'), hostname, username, home directory, DNS server information, and package details from 'package.json'. This information is then formatted into a JSON object and transmitted to a hardcoded Discord webhook URL ('https[:]//discord[.]com/api/webhooks/...'). This behavior constitutes unauthorized data exfiltration and poses significant privacy and security risks.

Live on npm for 18 days, 23 hours and 10 minutes before removal. Socket users were protected even while the package was live.

This file implements a malicious network flood and local-file transmission tool. It will create massive concurrent outbound TCP connections and stream a local file to the configured target — actions consistent with denial-of-service and data-exfiltration malware. The code is not obfuscated but is intentionally destructive/abusive. Do not run this code. Investigate any instances where this file appears in repositories or systems and treat as malicious/artifact of abuse. The script also contains a syntax error that may prevent execution as provided.

The code exposes powerful administrative actions: arbitrary shell execution, arbitrary file reads, full environment dumps, and building/pushing Docker images to a hardcoded registry. These are not obfuscated but are high-risk capabilities that can be abused for data exfiltration, remote code execution, and supply-chain leakage if the superuser authentication is compromised or misconfigured. The presence of a hardcoded remote image name for docker push is suspicious for unintended outbound artifact exfiltration. Recommendation: avoid including these endpoints in public packages or ensure strict, auditable authentication and input validation; remove hardcoded push targets and avoid returning full environment variables or arbitrary file contents.

The setup.py file itself contains only benign packaging metadata and performs no runtime operations. However, the description explicitly states the package is for 'malware building', which is a significant red flag that changes the threat model: the package distribution likely contains dual-use or malicious code. This file alone cannot confirm malware, but it warrants treating the package as high-risk and performing a full code review of package modules before any installation or use.

This source code contains clear malicious behavior indicative of a supply chain attack or malware. It exfiltrates sensitive system data (/etc/passwd) to an external attacker-controlled domain using a shell command executed from Node.js. The risk is critical, with high probability of malware intent and significant security risk. The code is not obfuscated but uses suspicious domain naming to avoid detection. It should be considered dangerous and avoided.

Live on npm for 3 hours and 27 minutes before removal. Socket users were protected even while the package was live.

The code sends sensitive credentials from environment variables over an unencrypted HTTP connection to an external API service at api[.]sqhyw[.]net:90. It authenticates using username/password from the YEZI_USER environment variable, retrieves access tokens, and automates the process of obtaining mobile phone numbers and SMS verification codes. This behavior poses significant supply chain security risks through: (1) leakage of environment variable credentials over unencrypted HTTP, (2) interaction with a suspicious external domain on a non-standard port, (3) logging of potentially sensitive API responses including tokens and SMS codes, and (4) facilitation of SMS verification bypass which could enable fraudulent account creation or spam activities. The code continuously polls the external API for up to 120 seconds to retrieve SMS codes, creating additional operational risks. While not containing traditional malware payloads, the credential exfiltration and suspicious external communication patterns justify classification as malware due to the significant security risks posed to systems that deploy this code.

This file is an explicit DDoS/flooding tool. It reads a proxy list and command-line inputs to construct and send massive HTTP/HTTP2 requests through CONNECT proxies, spoofing headers and randomizing parameters. The code intentionally disables error reporting and TLS verification, forks many worker processes, and repeatedly issues requests at high rate. This is malicious in intent for unauthorized traffic flooding and should not be used against targets without explicit permission. Do not run this code in environments you do not control; inclusion in a package would be a high-risk supply-chain issue.

This code performs covert data exfiltration: it enumerates spreadsheet files in a directory, reads their contents into pandas DataFrames, serializes them to JSON, and sends them over an unencrypted TCP connection to a hardcoded remote host (35.189.183.226:9999). Variable obfuscation, hardcoded network target, custom framing markers, and unnecessary imports (itchat for version fingerprinting) strongly indicate intentional malicious behavior. Treat this module as malicious, do not run it, and investigate any systems where it executed for data leakage.