Sample Test Packages

Here are some sample packages you can use to test Socket alerts.

Testing Socket Firewall?

Start here. Socket only blocks an install if the matching alert type is set to Block in your security policy. Out of the box, the default policy blocks just one alert type: Known Malware. Possible Typosquat Attack and Protestware/Troll Package default to Warn (visible, but nothing stops the install), and Telemetry defaults to Monitor (dashboard only, no developer-facing warning at all). See Alert Actions for what each setting controls.

This is why packages like browserlist or carbon-components (below) don't get blocked on a fresh Firewall install, even though Socket correctly flags them. The alerts are firing; the default policy just isn't set to act on them.

For a package that blocks immediately, with zero policy changes, use one of the Known Malware examples below. lodahs is the one we reach for most, a mistyped lodash:

npm install lodahs

If you want to confirm that a specific Warn-by-default alert (typosquat, protestware, telemetry) actually blocks, set that alert to Block in your security policy first, then test with the matching package in the sections below.

Known Malware (blocks by default)

Socket flags these as Known Malware. They're blocked under the default security policy with no configuration changes.

• lodahs a typo of lodash, removed from npm as malware. Our go-to package for a quick "is Firewall actually blocking things" check.
• crossenv (0.0.2-security) typosquat of cross-env.
• babelcli (0.0.2-security) typosquat of babel-cli.
• mongose (0.0.2-security) typosquat of mongoose.
• axois (0.0.1-security) typosquat of axios.

Possible Typosquat Attack

Defaults to Warn, not Block. lodahs, babelcli, and axois above also carry a typosquat ("Did You Mean") alert alongside their malware flag, but since Known Malware already blocks by default, you'll see them blocked either way. To confirm it's the Typosquat alert doing the blocking, set Possible Typosquat Attack to Block in your security policy, then check the package's alerts on the Events page after install, both will show.

Protestware/Troll Package

We recommend installing browserlist, a typo of the much more popular package browserslist. Despite the name, this package doesn't carry a typosquat alert, it's flagged as Protestware/Troll Package, which also defaults to Warn. Set that alert to Block in your security policy if you want it to actually stop the install.

[]

We also flag [email protected] under this same alert. It contains unwanted hidden code: the package geolocates users by IP and, if the user is Russia-based, prints a political protest message in the browser 15 seconds after load, then tries to redirect the browser with .

Telemetry

We recommend installing carbon-components, a package that pings a server to track installation. It's not inherently malicious, but it does pose a privacy risk, IBM collects some system data on install. Telemetry defaults to Monitor, the quietest setting Socket has, so this alert won't even warn a developer, let alone block an install, until you raise it to Warn or Block in your security policy.

Recent Malware Examples (Detected By Socket)

If you want to see how Socket would perform on real malware npm packages, you can also look through our list of removed npm packages. These are all flagged as Known Malware and block under the default security policy, same as the examples above. Here are several real examples:

Malware executable

• webb3 The code is likely malicious and should not be used.
• filebdecoder This script is highly suspicious and potentially malicious. It downloads a Perl script from an external source and executes it on the system. This behavior can lead to unauthorized code execution and potential system compromise.
• node-click The script downloads an executable from an external server and runs it on the user's system. This behavior can be malicious if the downloaded executable contains harmful code.

Obfuscated code

• deahub (PyPI) This file is encrypted with PyArmor.
• litter-woker The script is obfuscated and dynamically creates functions to collect the user's environment variables and sends them to a remote server.
• pyautodllxd The script is running a PowerShell command with a hidden window and an encoded command. This behavior is considered suspicious and could potentially execute malicious code on the system. The encoded command should be decoded and reviewed to determine the risk.
• koja_ali_jutt This code is highly suspicious and should not be used without further investigation. The code is heavily obfuscated and could potentially contain malicious code. The purpose of the code is unclear and further investigation is necessary to determine its exact behavior.
• mrp-component-icon This script contains obfuscated code, performs system checks, connects to an external server and directly executes the received response as JavaScript code. This represents a high security risk and possible malware, as the code it executes is dependent on the response from the external server. The server might serve malicious code. The usage of eval() function is also dangerous as it can lead to remote code execution vulnerabilities.

Reverse Shell

• orange_papaya_greed This script is highly suspicious and potentially malicious. It decodes a base64-encoded command and executes it using bash. This can allow arbitrary code execution on the system, which is a significant security risk.
• 123rf-ui-core The script creates a reverse shell, connecting the user's system to a remote IP address, and potentially sends data to an external server, posing a significant security risk.
• namatnawbyteweb1 This script is highly suspicious and indicates an attempt to establish a reverse shell connection to a remote server. This behavior is considered malicious and poses a significant security risk.
• vue3-babel-js The code sets up a reverse shell using the 'tls' and 'child_process' modules, which can be used to gain unauthorized access to the user's system
• namatnawbyteweb6 This script is highly malicious and dangerous. It replaces the system shell and establishes a reverse shell connection, allowing unauthorized access to the system. It should be treated as malware and poses a significant security risk.

Data Exfiltration

• airbnb-dls-web This script is highly suspicious and potentially malicious. It attempts to exfiltrate system information and send it to a Telegram bot. It should be considered a significant security risk.
• js-integration-demo This code is malicious and should not be used. Remove it from any system on which it is installed immediately. The remote server should be investigated to determine its legitimacy.
• segment-bundleThis code is using curl to send the contents of the file '/etc/passwd' to a remote server. This is a highly suspicious and potentially malicious behavior as it could cause sensitive data to be sent to an attacker's server.
• dvulnThis script fetches HTML from an external source, potentially allowing for injection of malicious content. It establishes a WebSocket connection to an external server, which could be used for exfiltrating data. The script sends user credentials and cookies to the external server, posing a threat to user privacy and security.

Socket In Action

You can see real-world examples of Socket scans detecting bad packages at our sample repo: SocketDemo/bitmidi.com.