{"Socket Weekly: 3/30

53:I[641815,["/_next/static/immutable/chunks/0d0inunyp-zwq.js","/_next/static/immutable/chunks/16vw-h-i4usng.js","/_next/static/immutable/chunks/3dc8anz5--q1w.js","/_next/static/immutable/chunks/3czibijl5lj74.js","/_next/static/immutable/chunks/43xmj4ii3f9ne.js","/_next/static/immutable/chunks/14uk5wz9a2pxr.js","/_next/static/immutable/chunks/191kn3mqh_30e.js","/_next/static/immutable/chunks/2j3dw4s7z5wob.js","/_next/static/immutable/chunks/3txe0joif93zp.js","/_next/static/immutable/chunks/0tl29vg7ktqu8.js","/_next/static/immutable/chunks/1tv8if6b_vyoa.js","/_next/static/immutable/chunks/0g73nyptz7r-z.js","/_next/static/immutable/chunks/12ho6o211wtc3.js","/_next/static/immutable/chunks/0ood5ko3ez57v.js","/_next/static/immutable/chunks/1seu7rekbu_a9.js","/_next/static/immutable/chunks/2dny6htvs67m_.js","/_next/static/immutable/chunks/2p_phd0ha026t.js","/_next/static/immutable/chunks/1esrje34lwjxh.js","/_next/static/immutable/chunks/3gsmcj9uqqm8_.js","/_next/static/immutable/chunks/3yl3ljyzgye6h.js","/_next/static/immutable/chunks/0i_tam0d0e_lu.js","/_next/static/immutable/chunks/1ov-hirp-ibwv.js","/_next/static/immutable/chunks/43nsotkrbwkgc.js","/_next/static/immutable/chunks/11fwha0ikyv-6.js","/_next/static/immutable/chunks/3sr8of28bmf6k.js","/_next/static/immutable/chunks/1hd7qc82j2hgu.js","/_next/static/immutable/chunks/1tmwsmnqhoh_4.js","/_next/static/immutable/chunks/2fzvz9cmuhbjo.js","/_next/static/immutable/chunks/0t3q2l527cq1e.js","/_next/static/immutable/chunks/0ydq7gxsp_yg6.js","/_next/static/immutable/chunks/4377kvat7ayqf.js","/_next/static/immutable/chunks/05tnn4vqz7vom.js","/_next/static/immutable/chunks/18mkaf75b33z_.js","/_next/static/immutable/chunks/0ju8equvfxcxt.js"],"FlowEmailStage"] 54:Tc954,

{"\n "}{"Socket Weekly: 3/30– 4/03"}{"\n "}{"\n "}{"\n \n \n \n"}{"\n"}{"\n"}{"\n"}{"\n"}{"\n"}

{"\n "}

{"\n"}

{"\n \n \n \n \n \n "}

{"\n "}{"\n "}

{"Node.js Maintainers Hunted in Coordinated Attack ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ \n"}

{"\n \n"}

{"\n "}

{" "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "} socket-weekly-header

{"\n "}{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes."}

{"\n "}

{"TOP STORY"}

{"\n"}

{"Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign"}

{"\n "}

{"Following the "}{"axios compromise,"}{" one of the worst supply chain attacks to hit npm, the maintainer "}{"confirmed it was social engineering"}{". That disclosure opened the floodgates: maintainers behind Lodash, Fastify, dotenv, mocha, Express, Node.js core, and many more, have all confirmed they were targeted in the same coordinated campaign, linked to DPRK-nexus group UNC1069. "}

{"\n"}

{"The playbook: fake companies, real Slack workspaces, spoofed video calls, and a prompt to install a \"missing component\" that drops a RAT. A compromised maintainer account is a direct write path into packages downloaded billions of times a week, and several of these attempts came frighteningly close."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"The Hidden Blast Radius of the Axios Compromise"}

{"\n"}

{" "}

{"\n"}

{"Axios only needed to be resolved somewhere in your dependency graph to affect you. This technical deep dive shows how open version ranges, transitive dependencies, and runtime installs can exponentially expand the blast radius of this compromise."}

{"\n "}

{"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation"}

{"\n"}

{" "}

{"\n"}

{"North Korean operators spent six months building relationships with Drift contributors, including in-person meetings and shared tooling, before stealing $285M. This is another example of patient, high-touch social engineering designed to blend into legitimate developer and business interactions."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"Securing the open source supply chain across GitHub"}
{"\n"}{" "}
{" "}{"\n"}
{"RubyGems Fracture Incident Report"}
{"\n"}{" "}
{" "}{"\n"}
{"Node.js Drops Bug Bounty Rewards After Funding Dries Up"}
{"\n"}{" "}
{" "}{"\n"}
{"CERT-EU Confirms European Commission Cloud Breach via Trivy Supply Chain Compromise"}
{"\n"}
{"Attempts to Exploit Exposed \"Vite\" Installs (CVE-2025-30208)"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}55:Tab4f, Socket Weekly: 3/30– 4/03

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign

Following the axios compromise, one of the worst supply chain attacks to hit npm, the maintainer confirmed it was social engineering. That disclosure opened the floodgates: maintainers behind Lodash, Fastify, dotenv, mocha, Express, Node.js core, and many more, have all confirmed they were targeted in the same coordinated campaign, linked to DPRK-nexus group UNC1069.

The playbook: fake companies, real Slack workspaces, spoofed video calls, and a prompt to install a "missing component" that drops a RAT. A compromised maintainer account is a direct write path into packages downloaded billions of times a week, and several of these attempts came frighteningly close.

MORE NEWS

The Hidden Blast Radius of the Axios Compromise

Axios only needed to be resolved somewhere in your dependency graph to affect you. This technical deep dive shows how open version ranges, transitive dependencies, and runtime installs can exponentially expand the blast radius of this compromise.

$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation

North Korean operators spent six months building relationships with Drift contributors, including in-person meetings and shared tooling, before stealing $285M. This is another example of patient, high-touch social engineering designed to blend into legitimate developer and business interactions.

{"TOP STORY"}

{"\n"}

{"North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads"}

{"\n "}

{"Contagious Interview has gone cross-ecosystem. This new cluster shows the same staged malware loader pattern now appearing across npm, PyPI, Go Modules, crates, and Packagist. The packages impersonate common developer tools to fetch second-stage RAT payloads that steal credentials and wallets and enable remote access."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"Anthropic Introduces Project Glasswing, an AI-Powered Push to Secure Critical Software"}

{"\n"}

{" "}

{"\n"}

{"Anthropic’s Project Glasswing announcement sent the security world into overdrive, as researchers and vendors scrambled to react to a model that can autonomously find and exploit vulnerabilities at a level approaching top human experts. The headline: its "}{"Mythos Preview model"}{" "}{"is already uncovering thousands of serious vulns and posting big benchmark gains (83% on CyberGym vs. 66% for its predecessor, and ~94% on SWE-bench Verified), while Anthropic is "}{"committing $100M in usage credits plus $4M in funding"}{" "}{"to bring those capabilities to defenders and open source maintainers."}

{"\n "}

{"Attackers Are Impersonating a Linux Foundation Leader in Slack to Target Open Source Developers"}

{"\n"}

{" "}

{"\n"}

{"Attackers are targeting open source maintainers through the tools they rely on, including Slack and other trusted community channels. In the latest campaign, a threat actor impersonated a Linux Foundation leader to lure developers into a multi-stage attack that ends in malware and credential theft. We’re increasingly seeing social engineering used as a direct path into the software supply chain."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"npm trusted publishing now supports CircleCI"}
{"\n"}{" "}
{" "}{"\n"}
{"AI Cybersecurity After Mythos: The Jagged Frontier"}
{"\n"}{" "}
{" "}{"\n"}
{"Cybercrime losses jumped 26% to $20.9 billion in 2025"}
{"\n"}{" "}
{" "}{"\n"}
{"Microsoft Releases Open Source Toolkit for AI Agent Runtime Security"}
{"\n"}
{"What’s coming to our GitHub Actions 2026 security roadmap"}
{"AI Tools Are Eroding Your Zero Trust Foundations"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}57:Tb038, Socket Weekly: Contagious Interview Goes Cross-Ecosystem

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

Contagious Interview has gone cross-ecosystem. This new cluster shows the same staged malware loader pattern now appearing across npm, PyPI, Go Modules, crates, and Packagist. The packages impersonate common developer tools to fetch second-stage RAT payloads that steal credentials and wallets and enable remote access.

MORE NEWS

Anthropic Introduces Project Glasswing, an AI-Powered Push to Secure Critical Software

Anthropic’s Project Glasswing announcement sent the security world into overdrive, as researchers and vendors scrambled to react to a model that can autonomously find and exploit vulnerabilities at a level approaching top human experts. The headline: its Mythos Preview model is already uncovering thousands of serious vulns and posting big benchmark gains (83% on CyberGym vs. 66% for its predecessor, and ~94% on SWE-bench Verified), while Anthropic is committing $100M in usage credits plus $4M in funding to bring those capabilities to defenders and open source maintainers.

Attackers Are Impersonating a Linux Foundation Leader in Slack to Target Open Source Developers

Attackers are targeting open source maintainers through the tools they rely on, including Slack and other trusted community channels. In the latest campaign, a threat actor impersonated a Linux Foundation leader to lure developers into a multi-stage attack that ends in malware and credential theft. We’re increasingly seeing social engineering used as a direct path into the software supply chain.

{"TOP STORY"}

{"\n"}

{"108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure"}

{"\n "}

{"Most users have no real visibility into what their browser extensions are doing. This week, we uncovered a campaign spanning 108 extensions and roughly 20,000 Chrome Web Store installs, all tied to the same C2 infrastructure. These extensions stole Google account data, hijacked Telegram Web sessions, and gave operators a backdoor into victims’ browsers."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"NIST Officially Stops Enriching Most CVEs as Vulnerability Volume Skyrockets"}

{"\n"}

{" "}

{"\n"}

{"NIST has officially stopped enriching most CVEs in the National Vulnerability Database, conceding it can no longer keep up with the volume of submissions. Going forward, the NVD will focus on vulnerabilities tied to CISA’s KEV catalog, federal government systems, and software deemed critical under Executive Order 14028. Most other CVEs will be dumped into a “Not Scheduled” bucket without the CVSS and CPE data security teams need to prioritize and map affected software."}

{"\n "}

{"OpenAI Announces GPT-5.4-Cyber for Defensive Security Work"}

{"\n"}

{" "}

{"\n"}

{"OpenAI says it is preparing for more capable models in the months ahead by fine-tuning systems specifically for defensive cybersecurity use cases, starting with GPT-5.4-Cyber, a more cyber-permissive variant of GPT-5.4. The announcement also introduced new "}{"Cybersecurity Grant Program"}{" "}{"recipients, including Socket, Semgrep, Calif, and Trail of Bits, with grant support paired with access to more cyber-permissive frontier models for qualified defenders."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"Vercel April 2026 security incident"}
{"\n"}{" "}
{" "}{"\n"}
{"GitHub: Secret scanning pattern updates and product improvements"}
{"\n"}{" "}
{" "}{"\n"}
{"OpenSSF: Using Runtime Context to Win the Vulnerability Management Battle"}
{"\n"}
{"Europol-supported global operation targets over 75,000 users engaged in DDoS attacks"}
{"AI Companies to Play Bigger Role in CVE Program, Says CISA"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}59:Taa3e, Socket Weekly: OpenAI Announces GPT-5.4-Cyber

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure

Most users have no real visibility into what their browser extensions are doing. This week, we uncovered a campaign spanning 108 extensions and roughly 20,000 Chrome Web Store installs, all tied to the same C2 infrastructure. These extensions stole Google account data, hijacked Telegram Web sessions, and gave operators a backdoor into victims’ browsers.

MORE NEWS

NIST Officially Stops Enriching Most CVEs as Vulnerability Volume Skyrockets

NIST has officially stopped enriching most CVEs in the National Vulnerability Database, conceding it can no longer keep up with the volume of submissions. Going forward, the NVD will focus on vulnerabilities tied to CISA’s KEV catalog, federal government systems, and software deemed critical under Executive Order 14028. Most other CVEs will be dumped into a “Not Scheduled” bucket without the CVSS and CPE data security teams need to prioritize and map affected software.

OpenAI Announces GPT-5.4-Cyber for Defensive Security Work

OpenAI says it is preparing for more capable models in the months ahead by fine-tuning systems specifically for defensive cybersecurity use cases, starting with GPT-5.4-Cyber, a more cyber-permissive variant of GPT-5.4. The announcement also introduced new Cybersecurity Grant Program recipients, including Socket, Semgrep, Calif, and Trail of Bits, with grant support paired with access to more cyber-permissive frontier models for qualified defenders.

{"TOP STORY"}

{"\n"}

{"Checkmarx KICS and Bitwarden CLI Hit in Coordinated Supply Chain Attacks"}

{"\n "}

{"Checkmarx KICS"}{" (Docker images, VS Code extensions) and "}{"Bitwarden CLI"}{" were both compromised this week, as attackers continue systematically targeting infrastructure-adjacent security tools that sit close to developer credentials and build pipelines. Both compromises shared identical C2 infrastructure and credential harvesting techniques, pointing to coordinated campaign operations."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware"}

{"\n"}

{" "}

{"\n"}

{"The CanisterWorm playbook is back, and this time it's hitting AI tooling: Socket detected a postinstall payload in @automagik/genie and pgserve npm packages from Namastex Labs that steals dev secrets, sends them to an Internet Computer canister, and then uses stolen npm tokens to republish itself into more packages."}

{"\n "}

{"73 Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations"}

{"\n"}

{" "}

{"\n"}

{"We're tracking a cluster of 73 Open VSX sleeper extensions tied to the GlassWorm campaign that are clones of popular developer tools waiting for remote activation. Six clones have already been weaponized through normal update channels, part of a sleeper extension pattern where attackers build credibility before turning them into malware loaders."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"Trivy, KICS, and the shape of supply chain attacks so far in 2026"}
{"\n"}{" "}
{" "}{"\n"}
{"Inside GitHub's Fake Star Economy"}
{"\n"}{" "}
{" "}{"\n"}
{"Open Source and the Future of AI"}
{"\n"}
{"OpenAI Releases GPT‑5.5"}
{"AI threats in the wild: The current state of prompt injections on the web"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}5b:Ta9c7, Socket Weekly: Checkmarx KICS and Bitwarden CLI Hit in Coordinated Supply Chain Attacks

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Checkmarx KICS and Bitwarden CLI Hit in Coordinated Supply Chain Attacks

Checkmarx KICS (Docker images, VS Code extensions) and Bitwarden CLI were both compromised this week, as attackers continue systematically targeting infrastructure-adjacent security tools that sit close to developer credentials and build pipelines. Both compromises shared identical C2 infrastructure and credential harvesting techniques, pointing to coordinated campaign operations.

MORE NEWS

Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware

The CanisterWorm playbook is back, and this time it's hitting AI tooling: Socket detected a postinstall payload in @automagik/genie and pgserve npm packages from Namastex Labs that steals dev secrets, sends them to an Internet Computer canister, and then uses stolen npm tokens to republish itself into more packages.

73 Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations

We're tracking a cluster of 73 Open VSX sleeper extensions tied to the GlassWorm campaign that are clones of popular developer tools waiting for remote activation. Six clones have already been weaponized through normal update channels, part of a sleeper extension pattern where attackers build credibility before turning them into malware loaders.

{"TOP STORY"}

{"\n"}

{"Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise"}

{"\n "}

{"Mini Shai-Hulud was the week’s biggest supply chain story, starting with TeamPCP-linked "}{"compromises of SAP CAP and Cloud MTA npm packages"}{" before escalating into a compromise that wormed its way across 3 ecosystems: "}{"PyPI PyTorch lightning"}{" → "}{"npm intercom-client"}{" → "}{"Packagist intercom/intercom-php"}{". The attack shows how one compromised developer environment can become a bridge into the next package compromise, turning local installs, stolen credentials, and package publishing workflows into a path for spreading across open source ecosystems."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables"}

{"\n"}

{" "}

{"\n"}

{"In one of the wilder supply chain attacks we’ve seen lately, a maintainer sitting on the unscoped tanstack npm package tried to extort TanStack’s creator for $10,000, turned the package into “TanStack Player” for backlinks, and then shipped versions that stole .env files during install. In a now-deleted post on X, the maintainer apologized and claimed the malware was accidental AI-agent testing that he “forgot to remove” because he was studying for exams, which somehow makes the story even more bizarre."}

{"\n "}

{"Malicious Ruby Gems and Go Modules Impersonate Developer Tools to Steal Secrets and Poison CI"}

{"\n"}

{" "}

{"\n"}

{"A cross-ecosystem supply chain campaign used Ruby gems and Go modules that looked like normal developer tools, with some sitting dormant as sleeper packages before later updates added credential theft, GitHub Actions tampering, Go proxy manipulation, fake go wrappers, and SSH persistence."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"Copy Fail: 732 Bytes to Root on Every Major Linux Distribution."}
{"\n"}{" "}
{" "}{"\n"}
{"cPanel & WHM Authentication Bypass"}
{"\n"}{" "}
{" "}{"\n"}
{"PyPI Fixes High-Severity Access Control Issues Found in Security Audit"}
{"\n"}
{"Securing the git push pipeline: Responding to a critical remote code execution vulnerability"}
{"How the PyTorch Lightning Community Discovered a Supply Chain Attack and Fixed it in 42 Minutes"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}5d:Tb0f5, Socket Weekly: Mini Shai-Hulud Attack Spreads Across 3 Open Source Ecosystems

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise

Mini Shai-Hulud was the week’s biggest supply chain story, starting with TeamPCP-linked compromises of SAP CAP and Cloud MTA npm packages before escalating into a compromise that wormed its way across 3 ecosystems: PyPI PyTorch lightning → npm intercom-client → Packagist intercom/intercom-php. The attack shows how one compromised developer environment can become a bridge into the next package compromise, turning local installs, stolen credentials, and package publishing workflows into a path for spreading across open source ecosystems.

MORE NEWS

Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables

In one of the wilder supply chain attacks we’ve seen lately, a maintainer sitting on the unscoped tanstack npm package tried to extort TanStack’s creator for $10,000, turned the package into “TanStack Player” for backlinks, and then shipped versions that stole .env files during install. In a now-deleted post on X, the maintainer apologized and claimed the malware was accidental AI-agent testing that he “forgot to remove” because he was studying for exams, which somehow makes the story even more bizarre.

Malicious Ruby Gems and Go Modules Impersonate Developer Tools to Steal Secrets and Poison CI

A cross-ecosystem supply chain campaign used Ruby gems and Go modules that looked like normal developer tools, with some sitting dormant as sleeper packages before later updates added credential theft, GitHub Actions tampering, Go proxy manipulation, fake go wrappers, and SSH persistence.

{"TOP STORY"}

{"\n"}

{"pnpm 11 Adds Supply Chain Protection Defaults for Minimum Release Age and Exotic Subdependencies"}

{"\n "}

{"pnpm 11 tightens JavaScript supply chain security defaults. Minimum Release Age was already available as an opt-in setting, but pnpm 11 makes 24 hours the default, alongside blocking exotic subdependencies and a new Allow Builds model for controlling dependency build scripts. The new defaults target exactly the conditions that make modern package compromises move fast: newly published malicious versions, install-time execution, and hidden dependency sources. Package managers are increasingly where supply chain security decisions get enforced, and pnpm 11 is one example of how they're responding to the nonstop stream of attacks on the ecosystem."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"Critical vm2 Sandbox Escape Lets Untrusted JavaScript Run OS Commands"}

{"\n"}

{" "}

{"\n"}

{"A critical sandbox escape in vm2 (CVE-2026-26956) lets attacker-controlled JavaScript break isolation, access the host Node.js process, and run arbitrary OS commands. Our testing found the issue affects 66 vm2 releases, broader than the advisory's listed range, and a free Certified Patch is available for teams that can't immediately upgrade."}

{"\n "}

{"fsnotify Maintainer Dispute Sparks Supply Chain Concerns"}

{"\n"}

{" "}

{"\n"}

{"A maintainer access dispute in fsnotify, a Go library used by 321k projects for cross-platform file notifications, raised supply chain concerns this week after contributors were removed from the GitHub org and a deleted X post fueled takeover speculation. Although no code was compromised, governance ambiguity in this low-level dependency was enough to send users checking release history, watching forks, and asking whether routine updates were still safe."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"OpenJS Foundation Security Update: Q1 2026"}
{"\n"}{" "}
{" "}{"\n"}
{"5 Malicious NuGet Packages Impersonate Chinese UI Libraries to Distribute Crypto Wallet and Credential Stealer"}
{"\n"}{" "}
{" "}{"\n"}
{"Behind the Scenes Hardening Firefox with Claude Mythos Preview"}
{"\n"}
{"GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access"}
{"Scaling Trusted Access for Cyber with GPT‑5.5 and GPT‑5.5‑Cyber"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}5f:Ta910, Socket Weekly: pnpm 11 Tightens Supply Chain Defaults, Critical vm2 Sandbox Escape Disclosed, fsnotify Maintainer Dispute

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

pnpm 11 Adds Supply Chain Protection Defaults for Minimum Release Age and Exotic Subdependencies

pnpm 11 tightens JavaScript supply chain security defaults. Minimum Release Age was already available as an opt-in setting, but pnpm 11 makes 24 hours the default, alongside blocking exotic subdependencies and a new Allow Builds model for controlling dependency build scripts. The new defaults target exactly the conditions that make modern package compromises move fast: newly published malicious versions, install-time execution, and hidden dependency sources. Package managers are increasingly where supply chain security decisions get enforced, and pnpm 11 is one example of how they're responding to the nonstop stream of attacks on the ecosystem.

MORE NEWS

Critical vm2 Sandbox Escape Lets Untrusted JavaScript Run OS Commands

A critical sandbox escape in vm2 (CVE-2026-26956) lets attacker-controlled JavaScript break isolation, access the host Node.js process, and run arbitrary OS commands. Our testing found the issue affects 66 vm2 releases, broader than the advisory's listed range, and a free Certified Patch is available for teams that can't immediately upgrade.

fsnotify Maintainer Dispute Sparks Supply Chain Concerns

A maintainer access dispute in fsnotify, a Go library used by 321k projects for cross-platform file notifications, raised supply chain concerns this week after contributors were removed from the GitHub org and a deleted X post fueled takeover speculation. Although no code was compromised, governance ambiguity in this low-level dependency was enough to send users checking release history, watching forks, and asking whether routine updates were still safe.

{"TOP STORY"}

{"\n"}

{"TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack"}

{"\n "}

{"Attackers published 84 malicious versions across 42 @tanstack/* packages, including @tanstack/react-router (12 million weekly downloads), in the latest wave of the Mini Shai-Hulud campaign. Socket detected the compromised packages within six minutes of publication. The campaign has been working through high-trust namespaces across npm, PyPI, and Packagist for weeks, with earlier waves hitting UiPath, Mistral AI, OpenSearch, and Intercom's PHP and JavaScript SDKs."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks"}

{"\n"}

{" "}

{"\n"}

{"TeamPCP and BreachForums are running a $1,000 Monero contest for the biggest open source supply chain compromise, scored by weekly and monthly download counts, with the usual cybercrime forum currency of reputation and bragging rights on the side. Never ones to miss a punchline, TeamPCP also released Shai-Hulud as open source attack tooling so contestants don't have to write the malware themselves."}

{"\n "}

{"\n"}

{" "}

{"\n"}

{"Three malicious versions of node-ipc shipped a credential stealer targeting 90+ categories of developer and cloud secrets, exfiltrated through DNS TXT queries to blend into normal traffic. The attacker never touched npm or the active maintainers; they re-registered an expired email domain tied to a dormant maintainer account and used a routine password reset to gain publish rights, a reminder that abandoned accounts on widely used packages are their own category of supply chain risk."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"Mythos finds a curl vulnerability"}
{"\n"}{" "}
{" "}{"\n"}
{"Packagist Urges Immediate Composer Update After GitHub Actions Token Leak"}
{"\n"}{" "}
{" "}{"\n"}
{"Grafana GitHub Token Breach Led to Codebase Download and Extortion Attempt"}
{"\n"}
{"OpenAI: Our response to the TanStack npm supply chain attack"}
{"GitHub App installation tokens: Per-request override header"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}61:Ta7dc, Socket Weekly: Mini Shai-Hulud Hits TanStack, TeamPCP Gamifies Supply Chain Attacks, node-ipc Compromised

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack

Attackers published 84 malicious versions across 42 @tanstack/* packages, including @tanstack/react-router (12 million weekly downloads), in the latest wave of the Mini Shai-Hulud campaign. Socket detected the compromised packages within six minutes of publication. The campaign has been working through high-trust namespaces across npm, PyPI, and Packagist for weeks, with earlier waves hitting UiPath, Mistral AI, OpenSearch, and Intercom's PHP and JavaScript SDKs.

MORE NEWS

TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks

TeamPCP and BreachForums are running a $1,000 Monero contest for the biggest open source supply chain compromise, scored by weekly and monthly download counts, with the usual cybercrime forum currency of reputation and bragging rights on the side. Never ones to miss a punchline, TeamPCP also released Shai-Hulud as open source attack tooling so contestants don't have to write the malware themselves.

Three malicious versions of node-ipc shipped a credential stealer targeting 90+ categories of developer and cloud secrets, exfiltrated through DNS TXT queries to blend into normal traffic. The attacker never touched npm or the active maintainers; they re-registered an expired email domain tied to a dormant maintainer account and used a routine password reset to gain publish rights, a reminder that abandoned accounts on widely used packages are their own category of supply chain risk.

{"TOP STORY"}

{"\n"}

{"npm Ships Staged Publishing and New Install-Time Controls"}

{"\n "}

{"npm made staged publishing generally available this week, giving maintainers a way to publish package versions that require human approval before they become installable. The feature was already on npm’s roadmap, but it arrived alongside a "}{"forced reset of granular access tokens"}{" after Mini Shai-Hulud compromised hundreds of packages. npm also added new install-time controls for Git, remote URL, file, and directory dependencies, which have become a recurring blind spot in JavaScript supply chain attacks."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"Malicious Postinstall Hook Found Across 700+ GitHub Repositories"}

{"\n"}

{" "}

{"\n"}

{"Socket found the same malicious postinstall hook planted across more than 700 GitHub repositories, including PHP packages on Packagist and Node.js projects. The packages picked up install scripts through compromised upstream repos, putting suspicious JavaScript in a place many Composer users would not commonly check."}

{"\n "}

{"Laravel Lang Compromised with RCE Backdoor Across 700+ Versions"}

{"\n"}

{" "}

{"\n"}

{"Attackers compromised Laravel Lang packages with an RCE backdoor across more than 700 versions, targeting cloud keys, CI/CD secrets, database credentials, and developer environment variables. The packages are used for application localization, turning a routine dependency into a place attackers could hide credential-hunting code across release lines."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"Anthropic’s Mythos Preview Finds 10,000+ Serious Bugs"}
{"\n"}{" "}
{" "}{"\n"}
{"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io"}
{"\n"}{" "}
{" "}{"\n"}
{"GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension"}
{"\n"}
{"CISA Opens Public Nominations for KEV Catalog"}
{"Measuring LLMs’ ability to develop exploits"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}63:Ta8df, Socket Weekly: npm Responds as Package Compromises Spread

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

npm Ships Staged Publishing and New Install-Time Controls

npm made staged publishing generally available this week, giving maintainers a way to publish package versions that require human approval before they become installable. The feature was already on npm’s roadmap, but it arrived alongside a forced reset of granular access tokens after Mini Shai-Hulud compromised hundreds of packages. npm also added new install-time controls for Git, remote URL, file, and directory dependencies, which have become a recurring blind spot in JavaScript supply chain attacks.

MORE NEWS

Malicious Postinstall Hook Found Across 700+ GitHub Repositories

Socket found the same malicious postinstall hook planted across more than 700 GitHub repositories, including PHP packages on Packagist and Node.js projects. The packages picked up install scripts through compromised upstream repos, putting suspicious JavaScript in a place many Composer users would not commonly check.

Laravel Lang Compromised with RCE Backdoor Across 700+ Versions

Attackers compromised Laravel Lang packages with an RCE backdoor across more than 700 versions, targeting cloud keys, CI/CD secrets, database credentials, and developer environment variables. The packages are used for application localization, turning a routine dependency into a place attackers could hide credential-hunting code across release lines.

{"TOP STORY"}

{"\n"}

{"OSV Withdraws 157 Malware Reports After Automated False Positives Hit npm and PyPI"}

{"\n "}

{"OSV withdrew 157 malware reports after automated detections incorrectly flagged trusted npm and PyPI packages, including FastAPI, Strawberry GraphQL, TanStack packages, Nx packages, and other developer tools. Once those reports landed in OSV, they moved through the ecosystem with the same authority as legitimate security intelligence. The false positives activated incident response teams and put the burden on maintainers to prove they were not compromised."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"Famous Chollima Targets PHP Developers Through Compromised Packagist Package"}

{"\n"}

{" "}

{"\n"}

{"Famous Chollima, the North Korean threat group known for fake job interview lures, appears to have used a PHP/Packagist package path in a targeted developer lure. Socket found the loader in a compromised Laravel package, on a branch that could be installed through Composer, which is exactly the kind of “clone this repo, check out this branch, install this dependency” workflow developers see in interview tasks and take-home projects."}

{"\n "}

{"Rust Moves to Restrict LLM Use in Contributions After Months of Internal Debate"}

{"\n"}

{" "}

{"\n"}

{"Rust is moving toward an LLM policy for rust-lang/rust after months of debate over how to curb slop PRs. The proposed policy would block LLM-authored code, docs, diagnostics, comments, and PR descriptions. Project leaders and contributors are pushing back over whether the rule is too restrictive, too complicated, and too focused on how a contribution was made instead of whether it is worth reviewing."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"Disrupting Glassworm: Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet"}
{"\n"}{" "}
{" "}{"\n"}
{"Microsoft under fire for threatening security researcher with criminal investigation"}
{"\n"}{" "}
{" "}{"\n"}
{"OpenSSF: CRA Due Diligence Needs Machine-Readable OSS Signals"}
{"\n"}
{"Malicious NuGet Package Impersonates Sicoob SDK to Exfiltrate Banking Certificates and Passwords"}
{"OpenAI Publishes Frontier Governance Framework"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}65:Ta891, Socket Weekly: OSV False Positives, Famous Chollima, Rust to Restrict LLM Contributions

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

OSV Withdraws 157 Malware Reports After Automated False Positives Hit npm and PyPI

OSV withdrew 157 malware reports after automated detections incorrectly flagged trusted npm and PyPI packages, including FastAPI, Strawberry GraphQL, TanStack packages, Nx packages, and other developer tools. Once those reports landed in OSV, they moved through the ecosystem with the same authority as legitimate security intelligence. The false positives activated incident response teams and put the burden on maintainers to prove they were not compromised.

MORE NEWS

Famous Chollima Targets PHP Developers Through Compromised Packagist Package

Famous Chollima, the North Korean threat group known for fake job interview lures, appears to have used a PHP/Packagist package path in a targeted developer lure. Socket found the loader in a compromised Laravel package, on a branch that could be installed through Composer, which is exactly the kind of “clone this repo, check out this branch, install this dependency” workflow developers see in interview tasks and take-home projects.

Rust Moves to Restrict LLM Use in Contributions After Months of Internal Debate

Rust is moving toward an LLM policy for rust-lang/rust after months of debate over how to curb slop PRs. The proposed policy would block LLM-authored code, docs, diagnostics, comments, and PR descriptions. Project leaders and contributors are pushing back over whether the rule is too restrictive, too complicated, and too focused on how a contribution was made instead of whether it is worth reviewing.

{"TOP STORY"}

{"\n"}

{"Mini Shai-Hulud, Miasma, and Hades Spread Across npm and PyPI"}

{"\n "}

{"The Mini Shai-Hulud/Miasma/Hades cluster now spans 471 affected artifacts across npm and PyPI, including "}{"compromised Red Hat Cloud Services npm packages"}{", a "}{"Hades/Miasma PyPI wave"}{", and "}{"newer malicious PyPI packages targeting bioinformatics, AI, and MCP developers"}{". The campaign goes after developer and CI/CD secrets, but the newer PyPI packages also show a more specific scanner-evasion move: a fake prompt-injection header planted before the obfuscated Hades payload to trip up naive LLM-assisted analysis."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog"}

{"\n"}

{" "}

{"\n"}

{"A federal audit found that NIST and CISA used the same contractor while duplicating at least 21,000 vulnerability enrichment activities, wasting about $200,000 as the NVD backlog continued to grow. The finding puts hard numbers around a problem security teams have felt for more than two years: vulnerability data is still moving slower than the ecosystem built around it."}

{"\n "}

{"RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems"}

{"\n"}

{" "}

{"\n"}

{"RubyGems and Bundler 4.0.13 added an opt-in cooldown feature that delays newly published gems during dependency resolution. Package managers are starting to treat instant availability as a security tradeoff, especially when malicious releases often do the most damage in the first minutes after publication."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"1-Click GitHub Token Stealing via a VSCode Bug"}
{"\n"}{" "}
{" "}{"\n"}
{"AI, Open Source, and the Skills Imperative: Unpacking the 2026 State of Tech Talent Europe Report"}
{"\n"}
{"\n"}
{"Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator"}
{"\n"}
{"The EU Open Source Strategy"}
{"Taking Stock of the State of European Cyber Resilience Act (CRA) Compliance: An Urgent Wake-up Call for the Open Source Ecosystem"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}67:Tadf0, Socket Weekly: Mini Shai-Hulud Hits npm and PyPI, NIST Audit, RubyGems Cooldowns

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Mini Shai-Hulud, Miasma, and Hades Spread Across npm and PyPI

The Mini Shai-Hulud/Miasma/Hades cluster now spans 471 affected artifacts across npm and PyPI, including compromised Red Hat Cloud Services npm packages, a Hades/Miasma PyPI wave, and newer malicious PyPI packages targeting bioinformatics, AI, and MCP developers. The campaign goes after developer and CI/CD secrets, but the newer PyPI packages also show a more specific scanner-evasion move: a fake prompt-injection header planted before the obfuscated Hades payload to trip up naive LLM-assisted analysis.

MORE NEWS

Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog

A federal audit found that NIST and CISA used the same contractor while duplicating at least 21,000 vulnerability enrichment activities, wasting about $200,000 as the NVD backlog continued to grow. The finding puts hard numbers around a problem security teams have felt for more than two years: vulnerability data is still moving slower than the ecosystem built around it.

RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems

RubyGems and Bundler 4.0.13 added an opt-in cooldown feature that delays newly published gems during dependency resolution. Package managers are starting to treat instant availability as a security tradeoff, especially when malicious releases often do the most damage in the first minutes after publication.

{"TOP STORY"}

{"\n"}

{"140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack"}

{"\n "}

{"More than 140 @mastra/* npm packages were compromised in a coordinated supply chain attack. In a pattern eerily reminiscent of the Axios compromise, the Mastra packages stayed clean while the newly added easy-day-js dependency, a dayjs typosquat that first appeared as a decoy package, was later updated with a malicious postinstall hook. The payload was a cross-platform infostealer built to pull browser data, crypto wallet extension data, and other developer secrets during install."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE NEWS"}

{"\n"}

{"GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts"}

{"\n"}

{" "}

{"\n"}

{"GitHub is changing actions/checkout to block a pull_request_target pattern that researchers have warned about for years: privileged workflows checking out and running code from untrusted pull requests. The fix comes after a punishing run of supply chain attacks exploited privileged PR workflows, including Nx, PostHog’s Shai-Hulud incident, and TanStack, where routine PR automation became a path to tokens, secrets, cache poisoning, and unauthorized package publishing."}

{"\n "}

{"npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners"}

{"\n"}

{" "}

{"\n"}

{"A newly published npm package hid obfuscated JavaScript at the end of a 9 MB index.js packed with safety-triggering comments, fake system override instructions, and context flooding. The setup could trigger refusals, exhaust context windows, bury the executable path, or push a scanner to fail open. This attempt was conspicuous and noisy, but it shows where things are headed: attackers are starting to treat AI scanners as an attack surface."}

{"\n"}

{" "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"MORE WORTH READING"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}
{"The CRA Readiness Reality: What Changed ("}{"The CRA Readiness Reality: What Changed (and What Didn’t) Between 2025 and 2026?"}
{"\n"}{" "}
{" "}{"\n"}
{"GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions"}
{"\n"}
{"\n"}
{"Announcing TypeScript 7.0 RC"}
{"\n"}
{"Why pnpm no longer expands environment variables in a repository's .npmrc"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "}

{"\n "}

{"\n "} 512x512-logo-27148

{"\n "}{"\n "}

{"\n "}

{"\n "} LinkedIn

{"\n "}{"\n "}

{"\n "}

{"\n "} bluesky

{"\n "}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Socket Inc. "}

{"\n"}

{"Secure your supply chain. Ship with confidence."}

{"\n"}

{" "}

{"\n"}

{"2810 N Church St., Suite 71517, Wilmington,DE, 19802"}

{"\n"}

{"Book a Demo"}{" • "}{"Unsubscribe"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}69:Ta6b0, Socket Weekly: 140+ Mastra Packages Compromised, GitHub Blocks pull_request_target Risk

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack

More than 140 @mastra/* npm packages were compromised in a coordinated supply chain attack. In a pattern eerily reminiscent of the Axios compromise, the Mastra packages stayed clean while the newly added easy-day-js dependency, a dayjs typosquat that first appeared as a decoy package, was later updated with a malicious postinstall hook. The payload was a cross-platform infostealer built to pull browser data, crypto wallet extension data, and other developer secrets during install.

MORE NEWS

GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts

GitHub is changing actions/checkout to block a pull_request_target pattern that researchers have warned about for years: privileged workflows checking out and running code from untrusted pull requests. The fix comes after a punishing run of supply chain attacks exploited privileged PR workflows, including Nx, PostHog’s Shai-Hulud incident, and TanStack, where routine PR automation became a path to tokens, secrets, cache poisoning, and unauthorized package publishing.

npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners

A newly published npm package hid obfuscated JavaScript at the end of a 9 MB index.js packed with safety-triggering comments, fake system override instructions, and context flooding. The setup could trigger refusals, exhaust context windows, bury the executable path, or push a scanner to fail open. This attempt was conspicuous and noisy, but it shows where things are headed: attackers are starting to treat AI scanners as an attack surface.

{" "}{"Socket for Linear Is Now Available"}

{"\n"}

{"Create and manage Linear issues directly from Socket alerts. Teams can manually create issues from alerts, automate ticketing with rules, route findings by severity or category, and keep alert status synced between Socket and Linear."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "} CleanShot 2026-06-25 at 02.45.09@2x

{"\n "}{"\n "}

{"\n"}

{"\n "}

{"Introducing Manifest Alerts"}

{"\n"}

{"Socket now detects missing lockfiles in application repositories, helping teams identify projects where dependency trees are not pinned. Manifest Alerts surface risks in project setup, making it easier to spot where installs may drift over time."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "} CleanShot 2026-06-25 at 02.47.53@2x

{"\n "}{"\n "}

{"\n"}

{"\n "}

{"Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions"}

{"\n"}

{"Socket Firewall now extends install-time protection to editor extensions. Teams can block malicious or risky VS Code Marketplace and Open VSX extensions before they reach developer environments, closing off another path attackers have used in recent major supply chain attacks."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "} CleanShot 2026-06-25 at 02.49.55@2x

{"\n "}{"\n "}

{"\n"}

{"\n "}

{"Socket MCP Adds Org Alerts, Threat Feed Review, and Package Inspection"}

{"\n"}

{"Socket MCP now gives AI assistants authenticated access to live Socket data for deeper supply chain investigations. Teams can query organization alerts, review threat feed entries, and inspect package files directly from their AI coding tools."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "} CleanShot 2026-06-25 at 02.51.57@2x

{"\n "}{"\n "}

{"\n"}

{"\n "}

{"Introducing Repository Access Permissions and Custom Roles"}

{"\n"}

{"Socket now supports more granular access control with Custom Roles and Repository Access Permissions. Admins can define what actions a user can take, scope access to specific repositories, and apply least-privilege controls across teams, contractors, auditors, and security workflows."}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"Thanks for being part of what we’re building at Socket. More soon."}

{"\n"}

{"- Feross"}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n \n "}

{"\n \n "}

{"\n "}

{"\n"}

{"\n "}

{"\n "}{"\n "} [Socket] Logo - Export - Gradient - Black

{"\n "}{"\n "}

{"\n"}

{"\n "}{"\n "} Logo

{"\n "}{"\n "}

{"\n "}

{"\n Socket Inc., 2810 N Church St., Suite 71517, Wilmington, DE 19802, US\n "}

{"\n "}

{"\n "}{"Unsubscribe"}{"\n "}{"Manage preferences"}{"\n "}

{"\n "}

{"\n"}

{" "}

{"\n "}

{"\n Socket Inc., 2810 N Church St., Suite 71517, Wilmington, DE 19802, US\n "}

{"\n "}

{"\n "}{"Unsubscribe"}{"\n "}{"Manage preferences"}{"\n "}

{"\n "}

{"\n"}

{"\n "}

{"\n \n "}

{"\n "}

{"\n \n "}6b:Td051, Socket Launch Week Recap: 5 New Features

The last few months have been a big step up for Socket. More engineering and security teams are relying on us every day, and the volume of supply chain attacks has increased sharply. We’re scaling to meet the moment by making Socket faster, easier to use, and more deeply connected to the workflows teams already depend on.

Here’s what we shipped during Socket Launch Week, across triage, automation, access control, AI workflows, and Socket Firewall:

Socket for Linear Is Now Available

Create and manage Linear issues directly from Socket alerts. Teams can manually create issues from alerts, automate ticketing with rules, route findings by severity or category, and keep alert status synced between Socket and Linear.

Introducing Manifest Alerts

Socket now detects missing lockfiles in application repositories, helping teams identify projects where dependency trees are not pinned. Manifest Alerts surface risks in project setup, making it easier to spot where installs may drift over time.

Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions

Socket Firewall now extends install-time protection to editor extensions. Teams can block malicious or risky VS Code Marketplace and Open VSX extensions before they reach developer environments, closing off another path attackers have used in recent major supply chain attacks.

Socket MCP Adds Org Alerts, Threat Feed Review, and Package Inspection

Socket MCP now gives AI assistants authenticated access to live Socket data for deeper supply chain investigations. Teams can query organization alerts, review threat feed entries, and inspect package files directly from their AI coding tools.

Introducing Repository Access Permissions and Custom Roles

Socket now supports more granular access control with Custom Roles and Repository Access Permissions. Admins can define what actions a user can take, scope access to specific repositories, and apply least-privilege controls across teams, contractors, auditors, and security workflows.

Thanks for being part of what we’re building at Socket. More soon.

- Feross

33:[null,["$","div",null,{"className":"w-full flex-1 overflow-y-auto overflow-x-hidden pt-1 pb-[30vh]","children":["$","$L53",null,{"emails":[{"key":"pt1_k97z2gj81vy3sm72r5xxm7kh3s8e4mem","subject":"Socket Weekly: 3/30– 4/03","previewText":"Node.js Maintainers Hunted in Coordinated Attack","dayOffset":5.6,"categoryLabel":"Newsletter","jsx":"$54","html":"$55","width":672},{"key":"pt1_k97z99r4et1gm5nc9nnxepham98e4d7x","subject":"Socket Weekly: Contagious Interview Goes Cross-Ecosystem","previewText":"Contagious Interview spreads across ecosystems, Glasswing advances AI vuln hunting, and attackers target OSS maintainers via Slack impersonation","dayOffset":12.4,"categoryLabel":"Newsletter","jsx":"$56","html":"$57","width":672},{"key":"pt1_k97pd6wg5vhybqd4gk02tzazdh8e5q60","subject":"Socket Weekly: OpenAI Announces GPT-5.4-Cyber","previewText":"OpenAI introduces GPT-5.4-Cyber, NIST gives up on NVD backlog, and 108 Chrome extensions expose major browser-based threat campaign","dayOffset":19.6,"categoryLabel":"Newsletter","jsx":"$58","html":"$59","width":672},{"key":"pt1_k97z4ajqxh3papkbzpv9r29vn18e49kp","subject":"Socket Weekly: Checkmarx KICS and Bitwarden CLI Hit in Coordinated Supply Chain Attacks","previewText":"Checkmarx KICS, Bitwarden CLI, and Namastex.ai packages compromised in a week of supply chain attacks","dayOffset":26.7,"categoryLabel":"Newsletter","jsx":"$5a","html":"$5b","width":672},{"key":"pt1_k97h79qsg6nenaydc50syv7a4h8e45ac","subject":"Socket Weekly: Mini Shai-Hulud Attack Spreads Across 3 Open Source Ecosystems","previewText":"Mini Shai-Hulud Attack Spreads Across 3 Open Source Ecosystems","dayOffset":33.6,"categoryLabel":"Newsletter","jsx":"$5c","html":"$5d","width":672},{"key":"pt1_k97gz578fyrytmzejchkck80xd8e4a3y","subject":"Socket Weekly: pnpm 11 Tightens Supply Chain Defaults, Critical vm2 Sandbox Escape Disclosed, fsnotify Maintainer Dispute","previewText":"pnpm makes 24-hour release cooldowns the default, a critical sandbox escape hits 66 vm2 versions, and a Go maintainer dispute raises supply chain concerns.","dayOffset":41.2,"categoryLabel":"Newsletter","jsx":"$5e","html":"$5f","width":672},{"key":"pt1_k97j6612er60qwtzkpdxkz457d8e496h","subject":"Socket Weekly: Mini Shai-Hulud Hits TanStack, TeamPCP Gamifies Supply Chain Attacks, node-ipc Compromised","previewText":"84 TanStack npm packages caught in the latest Mini Shai-Hulud wave, TeamPCP runs a $1,000 contest for the biggest open source compromise, and a dormant maintainer account opens the door on node-ipc.","dayOffset":48.3,"categoryLabel":"Newsletter","jsx":"$60","html":"$61","width":672},{"key":"pt1_k97hkv1420xbacj798sq5khcth8e4ya6","subject":"Socket Weekly: npm Responds as Package Compromises Spread","previewText":"npm shipped staged publishing and new install-time controls. Also: 700+ GitHub repos hit with a malicious postinstall hook, and Laravel Lang backdoored across 700+ versions.","dayOffset":55.5,"categoryLabel":"Newsletter","jsx":"$62","html":"$63","width":672},{"key":"pt1_k97rmme195a3y0mq6xxsya65t98e4f30","subject":"Socket Weekly: OSV False Positives, Famous Chollima, Rust to Restrict LLM Contributions","previewText":"OSV withdrew 157 false malware reports after npm and PyPI packages were incorrectly flagged. Also: Famous Chollima targets PHP developers through Packagist, and Rust moves to restrict LLM-authored…","dayOffset":62.4,"categoryLabel":"Newsletter","jsx":"$64","html":"$65","width":672},{"key":"pt1_k97ra50t454px6zmvr7vbk95z58e5gg9","subject":"Socket Weekly: Mini Shai-Hulud Hits npm and PyPI, NIST Audit, RubyGems Cooldowns","previewText":"Mini Shai-Hulud, Miasma, and Hades hit npm and PyPI. Also: a federal audit faults NIST’s NVD backlog response, and RubyGems adds cooldowns for new gems.","dayOffset":69.7,"categoryLabel":"Newsletter","jsx":"$66","html":"$67","width":672},{"key":"pt1_k97nxdykhpz3efbd90d0nx6y358e51gp","subject":"Socket Weekly: 140+ Mastra Packages Compromised, GitHub Blocks pull_request_target Risk","previewText":"More than 140 Mastra npm packages were compromised through a dayjs typosquat. Also: GitHub tightens pull_request_target, and an npm package tests prompt injection against AI malware scanners.","dayOffset":83.1,"categoryLabel":"Newsletter","jsx":"$68","html":"$69","width":672},{"key":"pt1_k97nn6aarpyw59qrctr3nxw0h58e52k9","subject":"Socket Launch Week Recap: 5 New Features","previewText":"New updates across triage, automation, access control, AI workflows, and Socket Firewall.","dayOffset":86.4,"categoryLabel":"Newsletter","jsx":"$6a","html":"$6b","width":672}],"brand":{"domain":"socket.dev","name":"Socket"}}]}],"$L6c"]

Never let a signup go cold again.

Socket Weekly: 3/30– 4/03

Never let a signup go cold again.

Socket Weekly: 3/30– 4/03