npm malware

@npm_malware

📣 We tweet malicious packages detected on npm in real-time. 🚨 Not affiliated with @npmjs or @github. 🛡 Powered by the @SocketSecurity threat feed. ✨

socket.dev Joined August 2022

13 Following 3.7K Followers 7.8K Posts

Latest posts 5

npm malware @npm_malware Apr 27

⚠️ New threat detected: devkit-scripts@1.0.3 ⚠️

Attributed by the Socket Threat Research Team to North Korea’s **“Contagious Interview”** operation, this package is a **multi-stage Node.js infostealer/loader** that executes immediately on install, st...

socket.dev/npm/package/de…

socket.dev devkit-scripts - npm Package File explorer - Socket Copyright (c) React Training 2015-present. Version: 1.0.3 was published by larevela. Start using Socket to analyze devkit-scripts and its dependencies...

npm malware @npm_malware Apr 27

⚠️ New threat detected: ozonex-sdk@1.0.5 ⚠️

This module is a high-risk remote code execution loader. It decodes hidden outbound URLs, downloads arbitrary JavaScript from the network, and executes it by streaming the payload into detached Node.js chil...

socket.dev/npm/package/oz…

socket.dev ozonex-sdk - npm Package File explorer - Socket [![NPM version][npm-image]][npm-url] [![Build status][travis-image]][travis-url] [![Test coverage][codecov-image]][codecov-url] [![Dependency Status][...

npm malware @npm_malware Apr 27

⚠️ New threat detected: angklarjs@1.1.4 ⚠️

The code performs unauthorized exfiltration of sensitive system information to an external Discord webhook without user consent. This constitutes malicious behavior consistent with spyware or backdoor malwar...

socket.dev/npm/package/an…

socket.dev angklarjs - npm Package File explorer - Socket Research project. Version: 1.1.4 was published by nepz. Start using Socket to analyze angklarjs and its dependencies to secure your app from supply ch...

npm malware @npm_malware Apr 27

⚠️ New threat detected: aoi.js@4.5.0-dev.7da9206.1628131335 ⚠️

This module is an interpreter for bot command code and performs dynamic loading/execution of per-function modules and sends outputs to Discord. The file itself does not contain obvious ha...

socket.dev/npm/package/ao…

npm malware @npm_malware Apr 26

⚠️ New threat detected: insane-unlimited-vc-glitch-for-nba-2k22-full-tutorial-537@1.0.2 ⚠️

The code engages in automated package creation and publishing, with the addition of posting content to WordPress sites using hard-coded credentials. This indic...

socket.dev/npm/package/in…

socket.dev insane-unlimited-vc-glitch-for-nba-2k22-full-tutorial-537 - ... insane-unlimited-vc-glitch-for-nba-2k22-full-tutorial-537. Version: 1.0.2 was published by atiaromaryalab. Start using Socket to analyze insane-unlimi...