Socket Weekly: 77 Firefox Wallet-Theft Extensions, Rust Crates Hit…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

77 Firefox Extensions Linked to Crypto Wallet and Credential Theft

Socket's research team linked 77 Firefox extensions in a single crypto-theft operation, 40 confirmed to steal wallet recovery phrases, private keys, and credentials while impersonating wallets like OKX, Rabby, and TronLink. Nine ran for months as benign sports-score tools before a routine update quietly converted them into wallet stealers. We're now scanning all 97k+ extensions listed in Mozilla's official addons.mozilla.org directory.

MORE NEWS

Popular Rust Crates Compromised in a Build-Time Supply Chain Attack

An attacker compromised three widely used Rust crates from the same maintainer, including arrayref, and added a dependency that runs malware during a normal Cargo build, before any of the crate's own code is called. It’s not just an npm problem anymore: this attack hit Rust crates with hundreds of millions of downloads.

Open VSX Unblocks Extension IDs That Were Used in a Malware Campaign

After Open VSX blocked 77 malicious extensions and published their IDs, it unblocked a few so legitimate maintainers could reclaim the names. That breaks any blocklist keyed on extension ID alone, because the old malware and the now-approved package resolve under the same identifier, and it points to a wider namespace gap where our team found hundreds of Open VSX IDs impersonating popular VS Code extensions.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.