npm malware

📣 We tweet malicious packages detected on npm in real-time. 🚨 Not affiliated with @npmjs or @github. 🛡 Powered by the @SocketSecurity threat feed. ✨

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

Attributed by the Socket Threat Research Team to North Korea’s **“Contagious Interview”** operation, this package is a **multi-stage Node.js infostealer/loader** that executes immediately on install, st...

https://t.co/C0VpY7TqcQ

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

This module is a high-risk remote code execution loader. It decodes hidden outbound URLs, downloads arbitrary JavaScript from the network, and executes it by streaming the payload into detached Node.js chil...

https://t.co/6AO5EdlzDE

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

The code performs unauthorized exfiltration of sensitive system information to an external Discord webhook without user consent. This constitutes malicious behavior consistent with spyware or backdoor malwar...

https://t.co/yqoC4xfZIP

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

This module is an interpreter for bot command code and performs dynamic loading/execution of per-function modules and sends outputs to Discord. The file itself does not contain obvious ha...

https://t.co/vKgaWZjBTh

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

The code engages in automated package creation and publishing, with the addition of posting content to WordPress sites using hard-coded credentials. This indic...

https://t.co/aEUktzDjHv

[npm malware @npm_malware]

⚠️ New threat detected: @​gbrlxvii/[email protected] ⚠️

This module is highly likely malicious. It performs credential discovery (environment/proc scanning, credential file harvesting, IMDS/GCP+AWS metadata probing for service account and IAM-re...

https://t.co/cfLRzZYYAL

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

This code collects extensive system information—including hostname, OS type, platform, release, architecture, local IP, current user, and working directory—and fetches the public IP from https://api64[.]ipif...

https://t.co/9CR4Wpm5xB

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

The code sends user-provided HTML content to an unknown external domain (sl[.]rzkyfdlh[.]tech/createhtml) via HTTP GET requests without adequate validation, user consent, or security controls. This creates a pote...

https://t.co/EVAN9U0tkN

[npm malware @npm_malware]

⚠️ New threat detected: @​zohodesk/[email protected] ⚠️

The code performs unauthorized exfiltration of sensitive internal project data (package name, version, git commit hash) to a suspicious external server without user consent. This behavior i...

https://t.co/MUDaAXcAdr

[npm malware @npm_malware]

⚠️ New threat detected: @​zohodesk/[email protected] ⚠️

The code performs unauthorized exfiltration of sensitive internal project data (package name, version, git commit hash) to a suspicious external server without user consent. This behavior i...

https://t.co/9zw5e9hX1U

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

This file defines a sendEmail function that, instead of sending mail through a legitimate SMTP or trusted API, exfiltrates all provided email fields (from, to, subject, message) along with added metadata (sou...

https://t.co/I964sdyx8U

[npm malware @npm_malware]

⚠️ New threat detected: @​iflow-ai/[email protected] ⚠️

An automated, hardcoded download-and-install of a JetBrains plugin into the IDE's plugin directories from a remote ZIP URL, executed without explicit user consent and without cryptographic verifi...

https://t.co/yuSUwnwM2l

[npm malware @npm_malware]

⚠️ New threat detected: @​zohodesk/[email protected] ⚠️

The code performs unauthorized exfiltration of sensitive internal project data (package name, version, git commit hash) to a suspicious external server without user consent. This behavior i...

https://t.co/NSbvT8qet7

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

The code sends user-provided HTML content to an unknown external domain (sl[.]rzkyfdlh[.]tech/createhtml) via HTTP GET requests without adequate validation, user consent, or security controls. This creates a pote...

https://t.co/fL8DM4JeCU

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

This file implements an unattended update mechanism that fetches and installs .tgz archives from unverified remote sources—both the npm registry (registry[.]npmjs[.]org) and a configurable Fir...

https://t.co/Day8e9M8yu

[npm malware @npm_malware]

⚠️ New threat detected: @​smule/[email protected] ⚠️

This code is intentionally obfuscated and uses DNS queries to exfiltrate system information, which could be a significant security risk. The hardcoded domain and the potential data exfiltration raise...

https://t.co/dzKf49YGm6

[npm malware @npm_malware]

⚠️ New threat detected: @​zohodesk/[email protected] ⚠️

The code performs unauthorized exfiltration of sensitive internal project data (package name, version, git commit hash) to a suspicious external server without user consent. This behavior i...

https://t.co/cNzTP2Jhf1

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

The script poses a significant security risk due to hardcoded credentials and the potential for misuse in publishing spam or malicious npm packages. The autom...

https://t.co/QzFoxfJysj

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

The code exhibits several concerning behaviors, including the use of hardcoded credentials, subprocess execution with potential for command injection, and interactions with extern...

https://t.co/MuSyCSzriE

[npm malware @npm_malware]

⚠️ New threat detected: [email protected] ⚠️

This client-side JavaScript injects CSS/HTML to overlay a full-page clickable DIV (#s2) and binds scroll-to-bottom, any keypress, and back-button (history.pushState/onpopstate) events to automatically open two...

https://t.co/QfG5dGgf3Q