Socket Weekly: Mini Shai-Hulud Hits npm and PyPI, NIST Audit…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Mini Shai-Hulud, Miasma, and Hades Spread Across npm and PyPI

The Mini Shai-Hulud/Miasma/Hades cluster now spans 471 affected artifacts across npm and PyPI, including compromised Red Hat Cloud Services npm packages, a Hades/Miasma PyPI wave, and newer malicious PyPI packages targeting bioinformatics, AI, and MCP developers. The campaign goes after developer and CI/CD secrets, but the newer PyPI packages also show a more specific scanner-evasion move: a fake prompt-injection header planted before the obfuscated Hades payload to trip up naive LLM-assisted analysis.

MORE NEWS

Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog

A federal audit found that NIST and CISA used the same contractor while duplicating at least 21,000 vulnerability enrichment activities, wasting about $200,000 as the NVD backlog continued to grow. The finding puts hard numbers around a problem security teams have felt for more than two years: vulnerability data is still moving slower than the ecosystem built around it.

RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems

RubyGems and Bundler 4.0.13 added an opt-in cooldown feature that delays newly published gems during dependency resolution. Package managers are starting to treat instant availability as a security tradeoff, especially when malicious releases often do the most damage in the first minutes after publication.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.

Socket Weekly: Mini Shai-Hulud Hits npm and PyPI, NIST Audit…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Mini Shai-Hulud, Miasma, and Hades Spread Across npm and PyPI

The Mini Shai-Hulud/Miasma/Hades cluster now spans 471 affected artifacts across npm and PyPI, including compromised Red Hat Cloud Services npm packages, a Hades/Miasma PyPI wave, and newer malicious PyPI packages targeting bioinformatics, AI, and MCP developers. The campaign goes after developer and CI/CD secrets, but the newer PyPI packages also show a more specific scanner-evasion move: a fake prompt-injection header planted before the obfuscated Hades payload to trip up naive LLM-assisted analysis.

MORE NEWS

Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog

A federal audit found that NIST and CISA used the same contractor while duplicating at least 21,000 vulnerability enrichment activities, wasting about $200,000 as the NVD backlog continued to grow. The finding puts hard numbers around a problem security teams have felt for more than two years: vulnerability data is still moving slower than the ecosystem built around it.

RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems

RubyGems and Bundler 4.0.13 added an opt-in cooldown feature that delays newly published gems during dependency resolution. Package managers are starting to treat instant availability as a security tradeoff, especially when malicious releases often do the most damage in the first minutes after publication.