Socket Weekly: Checkmarx KICS and Bitwarden CLI Hit in Coordinated…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

Checkmarx KICS and Bitwarden CLI Hit in Coordinated Supply Chain Attacks

Checkmarx KICS (Docker images, VS Code extensions) and Bitwarden CLI were both compromised this week, as attackers continue systematically targeting infrastructure-adjacent security tools that sit close to developer credentials and build pipelines. Both compromises shared identical C2 infrastructure and credential harvesting techniques, pointing to coordinated campaign operations.

MORE NEWS

Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware

The CanisterWorm playbook is back, and this time it's hitting AI tooling: Socket detected a postinstall payload in @automagik/genie and pgserve npm packages from Namastex Labs that steals dev secrets, sends them to an Internet Computer canister, and then uses stolen npm tokens to republish itself into more packages.

73 Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations

We're tracking a cluster of 73 Open VSX sleeper extensions tied to the GlassWorm campaign that are clones of popular developer tools waiting for remote activation. Six clones have already been weaponized through normal update channels, part of a sleeper extension pattern where attackers build credibility before turning them into malware loaders.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.