Socket Weekly: Mini Shai-Hulud Attack Spreads Across 3 Open Source…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise

Mini Shai-Hulud was the week’s biggest supply chain story, starting with TeamPCP-linked compromises of SAP CAP and Cloud MTA npm packages before escalating into a compromise that wormed its way across 3 ecosystems: PyPI PyTorch lightning → npm intercom-client → Packagist intercom/intercom-php. The attack shows how one compromised developer environment can become a bridge into the next package compromise, turning local installs, stolen credentials, and package publishing workflows into a path for spreading across open source ecosystems.

MORE NEWS

Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables

In one of the wilder supply chain attacks we’ve seen lately, a maintainer sitting on the unscoped tanstack npm package tried to extort TanStack’s creator for $10,000, turned the package into “TanStack Player” for backlinks, and then shipped versions that stole .env files during install. In a now-deleted post on X, the maintainer apologized and claimed the malware was accidental AI-agent testing that he “forgot to remove” because he was studying for exams, which somehow makes the story even more bizarre.

Malicious Ruby Gems and Go Modules Impersonate Developer Tools to Steal Secrets and Poison CI

A cross-ecosystem supply chain campaign used Ruby gems and Go modules that looked like normal developer tools, with some sitting dormant as sleeper packages before later updates added credential theft, GitHub Actions tampering, Go proxy manipulation, fake go wrappers, and SSH persistence.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.

Socket Weekly: Mini Shai-Hulud Attack Spreads Across 3 Open Source…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise

Mini Shai-Hulud was the week’s biggest supply chain story, starting with TeamPCP-linked compromises of SAP CAP and Cloud MTA npm packages before escalating into a compromise that wormed its way across 3 ecosystems: PyPI PyTorch lightning → npm intercom-client → Packagist intercom/intercom-php. The attack shows how one compromised developer environment can become a bridge into the next package compromise, turning local installs, stolen credentials, and package publishing workflows into a path for spreading across open source ecosystems.

MORE NEWS

Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables

In one of the wilder supply chain attacks we’ve seen lately, a maintainer sitting on the unscoped tanstack npm package tried to extort TanStack’s creator for $10,000, turned the package into “TanStack Player” for backlinks, and then shipped versions that stole .env files during install. In a now-deleted post on X, the maintainer apologized and claimed the malware was accidental AI-agent testing that he “forgot to remove” because he was studying for exams, which somehow makes the story even more bizarre.

Malicious Ruby Gems and Go Modules Impersonate Developer Tools to Steal Secrets and Poison CI

A cross-ecosystem supply chain campaign used Ruby gems and Go modules that looked like normal developer tools, with some sitting dormant as sleeper packages before later updates added credential theft, GitHub Actions tampering, Go proxy manipulation, fake go wrappers, and SSH persistence.