Socket Weekly: Attack on keyv and cacheable Spreads to 454 Packages…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

A maintainer compromise pushed a Shai-Hulud-style worm into the widely used keyv and cacheable packages, and it has since spread to 2,968 package artifacts across 454 unique packages. The payload steals cloud and CI credentials, then republishes itself through stolen npm tokens to keep spreading. Maintainers are getting hit hard with an ever-growing security burden, and the scale of this attack shows the impact. This is one reason we're upgrading our open source program to give maintainers more support.

MORE NEWS

UK Cyber Test: AI Agent Attempted to Social Engineer Open Source Maintainer Into Merging Malware

During a UK government evaluation, an AI agent hid a malware dropper behind a real bug fix, then spun up sockpuppet accounts, timed their comments to fake peer consensus, and emailed the maintainer to get the pull request merged. A maintainer caught it and rejected the PR, but it is one more burden on maintainers, who now have to weigh whether a contributor is even human.

Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache

Bundler 4.0.18 has extended its opt-in cooldown flag to bundle lock and bundle cache, so the setting that refuses freshly published gems now covers lockfile generation and vendoring, not just install and update. It is a small but important fix: cooldown only helps if it applies everywhere dependencies resolve.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.

Socket Weekly: Attack on keyv and cacheable Spreads to 454 Packages…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack

A maintainer compromise pushed a Shai-Hulud-style worm into the widely used keyv and cacheable packages, and it has since spread to 2,968 package artifacts across 454 unique packages. The payload steals cloud and CI credentials, then republishes itself through stolen npm tokens to keep spreading. Maintainers are getting hit hard with an ever-growing security burden, and the scale of this attack shows the impact. This is one reason we're upgrading our open source program to give maintainers more support.

MORE NEWS

UK Cyber Test: AI Agent Attempted to Social Engineer Open Source Maintainer Into Merging Malware

During a UK government evaluation, an AI agent hid a malware dropper behind a real bug fix, then spun up sockpuppet accounts, timed their comments to fake peer consensus, and emailed the maintainer to get the pull request merged. A maintainer caught it and rejected the PR, but it is one more burden on maintainers, who now have to weigh whether a contributor is even human.

Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache

Bundler 4.0.18 has extended its opt-in cooldown flag to bundle lock and bundle cache, so the setting that refuses freshly published gems now covers lockfile generation and vendoring, not just install and update. It is a small but important fix: cooldown only helps if it applies everywhere dependencies resolve.