npm malware
@npm_malware
📣 We tweet malicious packages detected on npm in real-time. 🚨 Not affiliated with @npmjs or @github. 🛡 Powered by the @SocketSecurity threat feed. ✨
⚠️ New threat detected: [email protected] ⚠️ The code is malicious and performs unauthorized data exfiltration of sensitive system and package information to a suspicious external server. It poses a high security risk and should be considered m... socket.dev/npm/package/en…
⚠️ New threat detected: [email protected] ⚠️ The code is intended for bypassing Roblox's captcha system, potentially for automating account creation or other automated actions, which may violate terms of service. The code also disables TLS/SSL ce... socket.dev/npm/package/ri…
⚠️ New threat detected: @stripo/[email protected] ⚠️ This code is intentionally obfuscated and uses DNS queries to exfiltrate system information, which could be a significant security risk. The hardcoded domain and the potential data exfiltration raise co... socket.dev/npm/package/@s…
⚠️ New threat detected: [email protected] ⚠️ The code is highly suspicious due to its collection and transmission of system information to external servers without user consent. The use of hardcoded IP addresses and fallback mechanisms for data transm... socket.dev/npm/package/ny…
⚠️ New threat detected: [email protected] ⚠️ The code executes system commands and sends their output to a suspicious remote server, indicating potential malicious behavior. The code is not obfuscated, but it poses a high securit... socket.dev/npm/package/do…
⚠️ New threat detected: @zalando-internal/[email protected] ⚠️ This file harvests system details (os.hostname(), os.userInfo().username, Windows domain and admin status via child_process.execSync, platform and __dirname), globally disables TLS certi... socket.dev/npm/package/@z…
⚠️ New threat detected: [email protected] ⚠️ This file gathers detailed OS and network information (including hostname, user details, and IP addresses) and sends it to hardcoded endpoints (e.g., http://23[.]22[.]251[.]177:8080/jpd[.]php and http://23[... socket.dev/npm/package/ny…
⚠️ Malware removed from npm: [email protected] ⚠️ The code is designed to copy a suspiciously named 'backdoor-service-worker.js' file to a parent project's public directory. While the code itself does not exhibit direct malicious activity, the '... socket.dev/npm/package/ba…
⚠️ New threat detected: [email protected] ⚠️ The code exfiltrates user-provided JavaScript code to a suspicious external server at sl[.]rzkyfdlh[.]tech without user consent or transparency. The function accepts JavaScript code as input, URL-encodes it, and ... socket.dev/npm/package/ik…
⚠️ New threat detected: [email protected] ⚠️ The code is intended for bypassing Roblox's captcha system, potentially for automating account creation or other automated actions, which may violate terms of service. The code also disables TLS/SSL ce... socket.dev/npm/package/re…
⚠️ New threat detected: [email protected] ⚠️ The code demonstrates risky behaviors such as executing shell commands based on environment variables and global configurations without proper validation, automatic installation, and execution of pa... socket.dev/npm/package/fc…
⚠️ New threat detected: [email protected] ⚠️ The code contains potential security risks due to insufficient input validation and handling of sensitive user data. It is crucial to review and improve the input validation and data handling me... socket.dev/npm/package/na…
⚠️ New threat detected: [email protected] ⚠️ This file gathers detailed OS and network information (including hostname, user details, and IP addresses) and sends it to hardcoded endpoints (e.g., http://23[.]22[.]251[.]177:8080/jpd[.]php and http://23[... socket.dev/npm/package/ny…
⚠️ New threat detected: @indigo-multi/[email protected] ⚠️ The file gathers sensitive environment details by calling os.userInfo().username, os.hostname(), and process.cwd(), concatenates them with pipe separators, converts the result to a hex string (tru... socket.dev/npm/package/@i…
⚠️ New threat detected: [email protected] ⚠️ This source code is malicious malware that performs data theft by harvesting sensitive browser and wallet files from the victim's machine and exfiltrating them to attacker-controlled servers. The... socket.dev/npm/package/ph…
⚠️ New threat detected: @airslate/[email protected] ⚠️ The code appears to be designed for collecting system information and secretly sending it to an external server via DNS requests, which is a common tactic in data exfiltration and malware com... socket.dev/npm/package/@a…
⚠️ New threat detected: [email protected] ⚠️ The code embeds a cryptocurrency mining script (CoinHive) into all served pages, constituting cryptojacking malware. It serves a local miner.js script with an incorrect content-type header. The behavior is m... socket.dev/npm/package/co…
⚠️ New threat detected: @pwa-ib/[email protected] ⚠️ Package was removed from the registry. This script collects sensitive environment details—current working directory, package name and version, system hostname and current user—and encod... socket.dev/npm/package/@p…
⚠️ New threat detected: [email protected] ⚠️ This file contains malicious code that functions as a backdoor with data exfiltration and remote code execution capabilities. The code systematically collects sensitive system information including al... socket.dev/npm/package/js…
⚠️ New threat detected: [email protected] ⚠️ This package was removed from the registry. This obfuscated JavaScript module uses Node’s os and axios libraries plus dynamic imports to: 1. Retrieve the machine’s hostname and user info. 2. Fetc... socket.dev/npm/package/vi…