Socket Weekly: Free VPN Extensions Steal Clipboard Data, Node.js…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

Socket researchers found Chrome and Firefox extensions posing as free VPNs that added clipboard stealers through later updates. The extensions kept enough proxy functionality to look legitimate while polling users’ clipboards every 500 milliseconds and exfiltrating copied data to attacker-controlled infrastructure. Some also targeted copied Solana addresses, replacing them with attacker-controlled wallet addresses when the extension detected crypto activity.

MORE NEWS

Node.js Considers Public Workflow for Security Reports Amid AI-Driven Surge

Node.js is considering moving lower-severity security reports into public workflows, reserving private embargo handling for higher-severity vulnerabilities. Maintainers say the project is still overwhelmed by duplicated, low-signal reports, and pausing bug bounty rewards “didn’t change anything.”

PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems

The North Korea-linked PolinRider campaign has expanded across npm, PyPI, RubyGems, and GitHub with packages aimed at developers working in AI, crypto, and Web3. The newer findings tie PolinRider to the broader Contagious Interview / Famous Chollima activity, where fake job tasks and open source dependencies are used to pull developer secrets from local environments.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.