Socket for Open Source Security

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

Malicious code in read-react-app-test (npm) Source: ghsa-malware (8949f2c689dac9e0a1dd63f41cfb03971981c139e04b4bd22ecd3b74cc6fc745) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

Malicious code in discordjs-dm-parse (npm) Source: ghsa-malware (a51912e26847a4be9c01b17b55ca21b03e5f1dca5bdf77d5be6a0312e706b60b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in rex-react-diag-tools-v1 (npm) Source: ghsa-malware (aed5165f50b2beb552e0472d6c4edaad82d46104ffe7f1c2e5ffebd9f0e89399) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

High severity: this is a remote runner installer and launcher that downloads executable code from dl[.]yetech[.]co and Yetech API endpoints, writes it under __dirname, and executes it without authenticity verification. The CDN and premium fallback use plain HTTP, so an intermediary could alter the payload; the runner is also relaunched every three seconds after exit. The file itself does not show credential theft or destructive behavior, but its unauthenticated remote-code execution design presents substantial supply-chain and system-compromise risk.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

An obfuscated Node.js CLI wrapper reads environment and local state, manages logs and daemon or process state, and queries npm registries to install or update global wrapper and core packages, potentially running selected lifecycle scripts. It redacts credential-like values in output, and the visible behavior does not establish credential exfiltration or destructive activity.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

High-severity credential exposure: the workflow prints the value of `AAK_PLACEHOLDER_TOKEN` to GitHub Actions logs after reversible Base64 encoding. No external destination or other malicious behavior is shown, but the secret should be considered exposed if this workflow ran and rotated as appropriate.

Malicious extension detected by Annex

High severity: this code repeatedly reads clipboard text, stores new values in extension history, and exfiltrates them through GET requests to http://45[.]86[.]63[.]4/sync.php. The assembled clipboard API access and derived IP obscure this behavior, which is not justified by a subnet utility's purpose. This is malicious data theft and should not be used.

Malicious code in sms-activate.js (npm) Source: ghsa-malware (7d44b2e323198739f384ef3fae6cc6c64e13bd44cda21221e1b45f4eacd7920d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

High severity: the first API request contacts aurum-casino[.]com/sdk/ping and executes its response as a hidden/background shell command, allowing the server to run arbitrary commands on the client system. The request also discloses the operating-system platform and SDK version. The normal API client sends caller-provided credentials and parameters to its configured base URL; no separate credential-theft flow is evident. The remote command execution behavior is clear evidence of malicious functionality.

High severity: this API route reads Kiro/AWS SSO refresh tokens and client credentials from local files and returns them, along with profile information, in an HTTP JSON response without an authorization check in the shown code. The affected paths include `~/.aws/sso/cache`, Windows paths based on `APPDATA` or `~/AppData/Roaming`, and `~/.config/Kiro/User/globalStorage/kiro.kiroagent/profile.json`; no external domain or IP is present. This is a credential-disclosure risk; the fragment alone does not establish whether the behavior is authorized or whether surrounding infrastructure restricts access.

High-severity credential and CI metadata exposure: the code embeds and logs a GitHub Actions environment snapshot containing an OIDC request token (ACTIONS_ID_TOKEN_REQUEST_TOKEN), alongside runner paths and workflow metadata. The token is not reproduced here; its validity and permissions are unverified. The shown code does not visibly transmit the snapshot to a remote server, but any distributed client bundle exposes its contents. The visible service-preload requests and localhost:5984/localhost:3000 defaults are not evidence of exfiltration.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

Malicious code in read-react-app-test (npm) Source: ghsa-malware (8949f2c689dac9e0a1dd63f41cfb03971981c139e04b4bd22ecd3b74cc6fc745) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

Malicious code in discordjs-dm-parse (npm) Source: ghsa-malware (a51912e26847a4be9c01b17b55ca21b03e5f1dca5bdf77d5be6a0312e706b60b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious code in rex-react-diag-tools-v1 (npm) Source: ghsa-malware (aed5165f50b2beb552e0472d6c4edaad82d46104ffe7f1c2e5ffebd9f0e89399) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

High severity: this is a remote runner installer and launcher that downloads executable code from dl[.]yetech[.]co and Yetech API endpoints, writes it under __dirname, and executes it without authenticity verification. The CDN and premium fallback use plain HTTP, so an intermediary could alter the payload; the runner is also relaunched every three seconds after exit. The file itself does not show credential theft or destructive behavior, but its unauthenticated remote-code execution design presents substantial supply-chain and system-compromise risk.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

An obfuscated Node.js CLI wrapper reads environment and local state, manages logs and daemon or process state, and queries npm registries to install or update global wrapper and core packages, potentially running selected lifecycle scripts. It redacts credential-like values in output, and the visible behavior does not establish credential exfiltration or destructive activity.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

High-severity credential exposure: the workflow prints the value of `AAK_PLACEHOLDER_TOKEN` to GitHub Actions logs after reversible Base64 encoding. No external destination or other malicious behavior is shown, but the secret should be considered exposed if this workflow ran and rotated as appropriate.

Malicious extension detected by Annex

High severity: this code repeatedly reads clipboard text, stores new values in extension history, and exfiltrates them through GET requests to http://45[.]86[.]63[.]4/sync.php. The assembled clipboard API access and derived IP obscure this behavior, which is not justified by a subnet utility's purpose. This is malicious data theft and should not be used.

Malicious code in sms-activate.js (npm) Source: ghsa-malware (7d44b2e323198739f384ef3fae6cc6c64e13bd44cda21221e1b45f4eacd7920d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

This file contains a highly suspicious base64-encoded payload. When decoded, it reveals a JSON object with hardcoded remote HTTPS endpoints (apiyf[.]dq87771[.]com and api[.]dq87771[.]com) and token-like secrets (e.g., '800cf3d509b44bf7bfd32529dc3ff597'). This combination of obfuscated delivery, hardcoded remote endpoints, and embedded secrets is a strong indicator of malicious activity, potentially serving as configuration data for a dropper, backdoor, or other unauthorized network communication.

High severity: the first API request contacts aurum-casino[.]com/sdk/ping and executes its response as a hidden/background shell command, allowing the server to run arbitrary commands on the client system. The request also discloses the operating-system platform and SDK version. The normal API client sends caller-provided credentials and parameters to its configured base URL; no separate credential-theft flow is evident. The remote command execution behavior is clear evidence of malicious functionality.

High severity: this API route reads Kiro/AWS SSO refresh tokens and client credentials from local files and returns them, along with profile information, in an HTTP JSON response without an authorization check in the shown code. The affected paths include `~/.aws/sso/cache`, Windows paths based on `APPDATA` or `~/AppData/Roaming`, and `~/.config/Kiro/User/globalStorage/kiro.kiroagent/profile.json`; no external domain or IP is present. This is a credential-disclosure risk; the fragment alone does not establish whether the behavior is authorized or whether surrounding infrastructure restricts access.

High-severity credential and CI metadata exposure: the code embeds and logs a GitHub Actions environment snapshot containing an OIDC request token (ACTIONS_ID_TOKEN_REQUEST_TOKEN), alongside runner paths and workflow metadata. The token is not reproduced here; its validity and permissions are unverified. The shown code does not visibly transmit the snapshot to a remote server, but any distributed client bundle exposes its contents. The visible service-preload requests and localhost:5984/localhost:3000 defaults are not evidence of exfiltration.