Socket Weekly: Miasma Mini Shai-Hulud Hits npm and Go Ecosystems…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Miasma Mini Shai-Hulud Hits Developer Infrastructure Across npm and Go Ecosystem

The Miasma Mini Shai-Hulud campaign hit LeoPlatform and RStreams npm packages, GitHub Actions workflows, and a Verana Go source archive, then expanded into the ImmobiliareLabs Backstage plugins for GitLab integration and LDAP auth. The affected projects sit close to developer infrastructure: data pipelines, internal portals, source-control integrations, authentication, and CI/CD. These newer waves also show the campaign moving beyond obvious install scripts into binding.gyp, GitHub Actions workflows, VS Code folder-open tasks, and AI-agent hooks.

MORE NEWS

Frontier AI Is Now Critical Infrastructure

The Fable 5 shutdown turned model access into a business continuity issue for teams that had already built frontier AI into development, security, and operations work. Anthropic now says Mythos 5 can be redeployed to a limited set of U.S. critical-infrastructure organizations, while it continues working with the government to make Fable 5 generally available again. The shutdown is pushing engineering teams to reassess single-provider AI pipelines.

Rolldown Pulls Rust React Compiler Integration After Binary Size Increase

Rolldown and Vite pulled a Rust-based React Compiler integration after maintainers decided the size cost was too high for a feature that would ship to all users by default. The change added about 5 MB to the binary, raising pushback over React-specific compiler support in framework-agnostic tooling. Maintainers are now experimenting with a smaller implementation that avoids shipping the full compiler path to every user by default.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.

Socket Weekly: Miasma Mini Shai-Hulud Hits npm and Go Ecosystems…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Miasma Mini Shai-Hulud Hits Developer Infrastructure Across npm and Go Ecosystem

The Miasma Mini Shai-Hulud campaign hit LeoPlatform and RStreams npm packages, GitHub Actions workflows, and a Verana Go source archive, then expanded into the ImmobiliareLabs Backstage plugins for GitLab integration and LDAP auth. The affected projects sit close to developer infrastructure: data pipelines, internal portals, source-control integrations, authentication, and CI/CD. These newer waves also show the campaign moving beyond obvious install scripts into binding.gyp, GitHub Actions workflows, VS Code folder-open tasks, and AI-agent hooks.

MORE NEWS

Frontier AI Is Now Critical Infrastructure

The Fable 5 shutdown turned model access into a business continuity issue for teams that had already built frontier AI into development, security, and operations work. Anthropic now says Mythos 5 can be redeployed to a limited set of U.S. critical-infrastructure organizations, while it continues working with the government to make Fable 5 generally available again. The shutdown is pushing engineering teams to reassess single-provider AI pipelines.

Rolldown Pulls Rust React Compiler Integration After Binary Size Increase

Rolldown and Vite pulled a Rust-based React Compiler integration after maintainers decided the size cost was too high for a feature that would ship to all users by default. The change added about 5 MB to the binary, raising pushback over React-specific compiler support in framework-agnostic tooling. Maintainers are now experimenting with a smaller implementation that avoids shipping the full compiler path to every user by default.