# Socket Weekly: Miasma Mini Shai-Hulud Hits npm and Go Ecosystems… Canonical: https://brew.new/browse/templates/email/pt1_k97xw6xx40a1ehm4dav0ymd6hn8e56e5 Brand: socket.dev Category: newsletter ![Preview of Socket Weekly: Miasma Mini Shai-Hulud Hits npm and Go Ecosystems…](https://cdn.brew.new/email-preview-6da12c4ff6023c80-tracking_r57x2df6z1extm5en4m55dfd8h8dtrgk-1789057640148.png) ## Email content socket-weekly-new-header Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes. TOP STORY Miasma Mini Shai-Hulud Hits Developer Infrastructure Across npm and Go Ecosystem The Miasma Mini Shai-Hulud campaign hit LeoPlatform and RStreams npm packages, GitHub Actions workflows, and a Verana Go source archive, then expanded into the ImmobiliareLabs Backstage plugins for GitLab integration and LDAP auth. The affected projects sit close to developer infrastructure: data pipelines, internal portals, source-control integrations, authentication, and CI/CD. These newer waves also show the campaign moving beyond obvious install scripts into binding.gyp, GitHub Actions workflows, VS Code folder-open tasks, and AI-agent hooks. MORE NEWS Frontier AI Is Now Critical Infrastructure The Fable 5 shutdown turned model access into a business continuity issue for teams that had already built frontier AI into development, security, and operations work. Anthropic now says Mythos 5 can be redeployed to a limited set of U.S. critical-infrastructure organizations, while it continues working with the government to make Fable 5 generally available again. The shutdown is pushing engineering teams to reassess single-provider AI pipelines. Rolldown Pulls Rust React Compiler Integration After Binary Size Increase Rolldown and Vite pulled a Rust-based React Compiler integration after maintainers decided the size cost was too high for a feature that would ship to all users by default. The change added about 5 MB to the binary, raising pushback over React-specific compiler support in framework-agnostic tooling. Maintainers are now experimenting with a smaller implementation that avoids shipping the full compiler path to every user by default. MORE WORTH READING npm adds preventive account protection for high-impact accounts OpenAI will delay GPT-5.6 after Trump administration request China’s 360 says it has developed tools to match Anthropic’s Mythos OpenAI Expands Daybreak With GPT-5.5-Cyber and Patch Automation A Mechanistic Explanation of Prompt Injection (and why you should study roles) X 512x512-logo-27148 LinkedIn bluesky Socket Inc. Secure your supply chain. Ship with confidence. 2810 N Church St., Suite 71517, Wilmington,DE, 19802 Book a Demo • Unsubscribe [Open and remix this design](https://brew.new/browse/templates/email/pt1_k97xw6xx40a1ehm4dav0ymd6hn8e56e5) [Browse email designs](https://brew.new/browse/templates)