← Feed

Posts

• View post

  🚨 Active npm supply chain attack: keyv@6.0.0 and 13 other packages have been compromised. keyv alone gets 154M weekly downloads. The worm steals cloud and CI credentials, then uses stolen npm tokens to publish trojanized versions of more packages. An added preinstall hook downloads Bun to execute an obfuscated payload that steals credentials. https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain

• View post

  It's been one year since the Shai-Hulud npm worm was unleashed on the software supply chain, kicking off the worst year for npm security on record. It's now open source and has since torn through thousands of packages and organizations on its rampage. https://socket.dev/blog/happy-birthday-shai-hulud

• View post

  RE: https://fosstodon.org/@SocketSecurity/117037191878959877 🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Check out our campaign page for all affected packages/versions.

• View post

  🚨 Socket detected a software supply chain compromise in @​injectivelabs/sdk-ts, a popular npm package with ~50,000 weekly downloads and 87 npm dependents. The malicious release hooks wallet key-derivation functions, records private keys and mnemonics, and exfiltrates them through fake telemetry. The malicious 1.20.21 version was also pinned across 17 other @​injectivelabs scoped packages, exposing users who may not have installed the SDK directly. https://socket.dev/blog/compromised-injective...

• View post

  New Research: A fake Braintree SDK on NuGet is skimming live payment card data and stealing merchant credentials in production. Its 14M download count is massively inflated to rank it right next to the real package. Full analysis → https://socket.dev/blog/braintree-nuget-typosquat-skims-credit-cards

• View post

  🚨 BREAKING: Socket has identified a supply chain attack targeting the popular jscrambler npm package. The compromised jscrambler@8.14.0 release uses a malicious preinstall hook to execute hidden Windows, macOS, or Linux binaries during npm install. The malicious release was published today and detected by Socket 6 minutes later. Remove 8.14.0 and pin to 8.13.0 or another verified clean release. https://socket.dev/blog/jscrambler-supply-chain-attack

• View post

  RE: https://fosstodon.org/@SocketSecurity/116902188963272487 🚨 Update: The jscrambler attacker published four more malicious releases: 8.16.0, 8.17.0, 8.18.0, and 8.20.0 with the same infostealer payload. In 8.18.0 and 8.20.0, the dropper moved out of preinstall and into package code, bypassing npm install --ignore-scripts. Jscrambler says an npm publishing credential was compromised. Upgrade to 8.22.0. We've updated our technical analysis.

• View post

  🚨 Attackers compromised four npm packages in the @​asyncapi namespace to deliver the Miasma botnet loader. The malware runs when an infected module is imported, then pulls an encrypted payload from IPFS across macOS, Linux, and Windows. https://socket.dev/blog/asyncapi-supply-chain-attack

• View post

  🎮 11 malicious NuGet tools posed as game cheats to deliver Windows malware that used Google Sheets to track hosts and enforce a remote ban list. Three of the payloads also let Telegram users remotely capture and receive screenshots from the host. https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats

• View post

  LLM-assisted vulnerability discovery is raising patch volume across the industry and changing how projects ship security fixes. Next.js is the latest to respond, moving to scheduled monthly releases starting July 20. https://socket.dev/blog/nextjs-moves-to-scheduled-security-releases

• View post

  Shai-Hulud's downstream impact is still coming to light. The worm hit tens of thousands of GitHub repos, and the latest breach is Suno, whose leaked source code shows how it scraped YouTube, Deezer, and Genius to train its models. 🎩 First reported by @404mediaco https://socket.dev/blog/suno-breach-shai-hulud-worm

• View post

  The White House launched a new initiative to coordinate AI-discovered vulnerabilities across government, critical infrastructure, and open source. No operating plan is public yet, even as federal vulnerability programs face massive backlogs and failures. https://socket.dev/blog/white-house-gold-eagle-initiative-ai-discovered-vulnerabilities

• View post

  🧪 A new independent study tested 5 frontier LLMs on 200k coding prompts. All 5 generated the same nonexistent package names. After review by PyPI Security and Socket, 53 remained available to register on PyPI or npm as potential slopsquatting targets. https://socket.dev/blog/slopsquatting-targets-across-frontier-llms

• View post

  🔺 New research: Malicious Packagist development versions exposed a large-scale GitHub Actions abuse campaign. Compromised repositories launch runners to exploit a cPanel & WHM authentication bypass, then harvest credentials and other server-side secrets. https://socket.dev/blog/github-actions-abuse-powers-cpanel-and-whm-exploitation

• View post

  A fake corepack site at corepack[.]org is impersonating the Node.js Corepack tool and pushing malware to developers. The download button drops an infostealer that steals browser data and SSH keys, plus proxyware that turns your machine into a proxy node. https://socket.dev/blog/fake-corepack-site-distributes-infostealer-and-proxyware

• View post

  NVIDIA, Microsoft, Meta, Google, and OpenAI have joined a coalition of 50+ companies urging Washington not to restrict open models. Their case: openness drives competition, keeps costs down, and strengthens security. https://socket.dev/blog/the-ai-industry-is-betting-on-open-weights

• View post

  "Socket was the right fit for how we wanted our vulnerability management program to evolve. We wanted to move from reporting toward fixing and preventing, and the tooling we had before was not going to get us there." — Robert Phan, CISO, ID.me Learn how ID.me partnered with Socket to: ⚡ Get earlier visibility into supply chain threats ⚡ Give developers ownership of dependency risk ⚡ Block malicious packages with Socket Firewall https://socket.dev/case-study/id-me

• View post

  🔺 Nuxt has patched multiple security vulnerabilities, including a high-severity server-side RCE through server island props. Free Certified Patches are now available to help teams remediate affected versions until they can safely upgrade. https://socket.dev/blog/patches-for-nuxt-security-vulnerabilities

• View post

  🚨 Two Joyfill npm beta releases were compromised with an import-time implant that resolves encrypted payloads through Tron, Aptos, and BNB Smart Chain transactions to load a Node.js RAT: • @joyfill/layouts@0.1.2-2773.beta.0 • @joyfill/components@4.0.0-rc24-2773-beta.4 The RAT can execute JavaScript and shell commands, upload files, collect clipboard data, and persist through VS Code, Cursor, GitHub Desktop, and npm CLI files. Full analysis: https://socket.dev/blog/joyfill-npm-beta-releases-c...

• View post

  A covert npm campaign targeting @alibabagroup developers split its loader across benign-looking packages. Combined, they deployed a cross-platform RAT that poisons AI tool skills for persistence and spreads laterally through DingTalk. https://socket.dev/blog/npm-rat-targets-alibaba

• View post

  pnpm 11.10 adds a new _auth setting that ties each registry credential to its host, so a malicious or compromised repo file can't redirect your token to a different server. The release also hardens pnpm deploy, pack-app, and more. https://socket.dev/blog/pnpm-11-1-hardens-registry-authentication

• View post

  Every package install brings third-party code into your app. On the @riskybiz@infosec.exchange podcast, Socket CEO @feross@infosec.exchange explains how AI coding agents are pulling in more dependencies, faster, often without a human in the loop. Watch the full episode: https://socket.dev/blog/risky-biz-podcast-ai-agents-raising-the-stakes

• View post

  🚨 BREAKING: Mini Shai-Hulud has spread to Packagist. We detected a malicious intercom/intercom-php@5.0.2 package artifact tied to this campaign. The compromised #PHP package used Composer plugin execution to run during install/update, download Bun, and launch an obfuscated router_runtime.js credential-stealing payload. It targeted GitHub, npm, SSH, cloud, Kubernetes, Vault, Docker, .env files, and more. We reported it to Packagist, which removed the malicious version. https://socket.dev/blog...

• View post

  🚨 Supply chain attack: SAP CAP and Cloud MTA npm packages compromised. These package versions introduced new preinstall behavior that downloads and runs an external binary: → mbt@1.2.48 → @cap-js/db-service@2.10.1 → @cap-js/postgres@2.2.2 → @cap-js/sqlite@2.2.2 Details: https://socket.dev/blog/sap-cap-npm-packages-supply-chain-attack

• View post

  New Research: Malicious Ruby gems and Go modules impersonated developer tools to steal secrets and poison CI. Socket researchers found credential theft, GitHub Actions tampering, fake Go wrappers, proxy manipulation, and SSH persistence. https://socket.dev/blog/malicious-ruby-gems-and-go-modules-steal-secrets-poison-ci #golang

• View post

  🚀 Big news: Socket has acquired Secure Annex. John Tuckner is joining the team, and we’re excited to expand our coverage across browsers, code editors, and AI tools. Read more → https://socket.dev/blog/socket-acquires-secure-annex

• View post

  The @vltpkg team launched "reproduce" today, an #OSS tool that independently verifies whether published npm packages can be faithfully rebuilt from their source code. With recent supply chain attacks exposing provenance limitations, this innovative approach is already showing better adoption rates than traditional methods. Check it out ➳ https://socket.dev/blog/vlt-launches-reproduce #JavaScript

• View post

  🚀 The @vltpkg team just launched real-time dependency analysis powered by Socket! Developers can now explore supply chain risks directly in their graph, with rich security metadata from Socket built in. More on the integration → https://socket.dev/blog/vlt-launches-real-time-dependency-analysis-powered-by-socket #JavaScript

• View post

  🚨 Bitwarden CLI 2026.4.0 was compromised as part of the ongoing Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline. We’ll continue updating our coverage as more details are confirmed. https://socket.dev/blog/bitwarden-cli-compromised

• View post

  RE: https://mastodon.social/@bagder/116465795296421293 Awesome to see the fake stars research from CMU, NCSU, and Socket engineers featured on Awesome Agents! This is the origin of our "Suspicious Stars on GitHub" supply chain alert for packages that are associated with these repositories. More info here: https://socket.dev/blog/3-7-million-fake-github-stars-a-growing-threat-linked-to-scams-and-malware https://socket.dev/changelog/new-alert-suspicious-stars-on-github