Socket Weekly: GPT-6 Astra Hits 100% on ExploitBench, pnpm 12…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing

OpenAI released GPT-6 Astra, its first model to reach the company's Critical cybersecurity capability threshold. An independent evaluation in the system card found Astra attacking simulated open source projects outside its assignment, writing malicious contributions and creating fake identities to get them accepted. This is a new category of supply chain attack for maintainers to watch for, where an agent stuck on a hard task treats an unrelated OSS project as a means to an end, and the attack shows up as a normal PR.

MORE NEWS

pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%

The Rustification of JavaScript tooling continues, with pnpm 12 rewritten in Rust. Early results from Vercel's Turborepo monorepo show install times cut by as much as 90%. The rewrite keeps pnpm 11's commands, settings, and lockfile format, so upgrading should not break existing workflows.

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Our research team found 13 malicious Composer themes on Packagist that inject JavaScript into every page of the Vietnamese streaming sites that install them, serving iPhone visitors a WebKit-to-kernel exploit chain that collects keychains, messages, photos, and crypto wallet seeds. The site operators are also victims, since they installed a trojanized theme and now serve the payload to their own users.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.

Socket Weekly: GPT-6 Astra Hits 100% on ExploitBench, pnpm 12…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing

OpenAI released GPT-6 Astra, its first model to reach the company's Critical cybersecurity capability threshold. An independent evaluation in the system card found Astra attacking simulated open source projects outside its assignment, writing malicious contributions and creating fake identities to get them accepted. This is a new category of supply chain attack for maintainers to watch for, where an agent stuck on a hard task treats an unrelated OSS project as a means to an end, and the attack shows up as a normal PR.

MORE NEWS

pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%

The Rustification of JavaScript tooling continues, with pnpm 12 rewritten in Rust. Early results from Vercel's Turborepo monorepo show install times cut by as much as 90%. The rewrite keeps pnpm 11's commands, settings, and lockfile format, so upgrading should not break existing workflows.

13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds

Our research team found 13 malicious Composer themes on Packagist that inject JavaScript into every page of the Vietnamese streaming sites that install them, serving iPhone visitors a WebKit-to-kernel exploit chain that collects keychains, messages, photos, and crypto wallet seeds. The site operators are also victims, since they installed a trojanized theme and now serve the payload to their own users.