🚨 New research: A spearphishing campaign published 27 malicious npm packages that host browser-run lures mimicking document portals and Microsoft sign-in to steal credentials. This operation targets manufacturing and healthcare orgs in the U.S. and allied countries. socket.dev/blog/spearph...

While we haven't seen major supply chain attacks hitting any of the major open-source ecosystems, the Socket Threat Research Team uncovered some fascinating and creative attack techniques worth sharing:

Published my take on METR's surprising study that I participated in: AI tools made experienced developers 19% slower (expectation was that they would become 40% faster with AI!)🤯 I dive into the why, where AI coding tools actually help, and how I've shifted from handholding AI to async delegation.

Two major npm supply chain discoveries this week from the Socket Research Team highlight a critical gap in traditional security approaches. Both threats would slip past security tools that rely on vulnerability databases or metadata alone.

Over the last few months, I have been picking up Cursor again after finding it not substantially improving my productivity when I tried it last year. It, and the LLMs powering AI code completions, have gotten so much better that I now really enjoy its agent workflow.

Our team at Socket has uncovered a Go module supply chain attack that deploys destructive disk-erasing payloads. A single code line triggers a shell script that overwrites disks, making data irretrievable. The attack leverages Go's open ecosystem, exploiting namespace confusion.

The Socket research team discovered seven "Coffin-Codes" packages that leveraged Gmail's SMTP protocol to create covert channels for extracting data and executing commands.

🚨SECURITY ALERT: Uncovering "The Bad Seeds" in Package Registries 🚨 Socket researchers have identified three malicious npm and PyPI packages that, like their namesake, are doing the devil's work - harvesting crypto wallet credentials while posing as innocent developer tools.

Last week, Socket researchers have discovered malicious npm packages deploying backdoors through fake Telegram bot libraries and payment integrations - details in thread below.

This is tremendous for TypeScript and JavaScript developers everywhere. We're building a new TypeScript that runs lighter, goes faster, and scales well on enormous codebases. This was a big decision and a lot of work, but we are seeing promising results for this new foundation!

Eleven years ago, Athan Reines and I set out to bring numerical and statistical computing to the web, which culminated in the creation of stdlib. What started as an ambitious idea has grown into a thriving open-source project which has truly taken off since being accepted into GSoC last year.

🚨 New research from the Socket threat analysis team! 🚨 We've uncovered a harmful PyPI package exploiting the Deezer API for systematic music piracy. Learn more about the detection of this exploit and its implications for developers and users alike: https://buff.ly/3D9CHjW

We uncovered a stealthy Go supply chain attack: a malicious BoltDB typosquat backdoored dev machines while looking clean on GitHub!

🚨 North Korean APT Lazarus is targeting developers with a malicious npm package! The postcss-optimizer package delivers BeaverTail malware, stealing credentials & deploying second-stage payloads. Read the full analysis on the Socket blog:

New on the Socket Blog: Kush Pandya uncovered a hidden kill switch in npm packages targeting two popular libraries, chalk and chokidar. This is a deep dive into a recent typo-squatting attack, illustrating how malicious packages can jeopardize your software supply chain.

2024 was transformational for stdlib and our mission to build the fundamental numerical library for the web. Huge thanks to the dozens of new contributors who helped make it possible! Read Athan Reines' retrospective here: https://buff.ly/4j6dIht Wishing everyone a great 2025!

Last week, we discovered a harmful npm package that pretends to be a video downloader. However, it secretly collected credentials and data by logging web form inputs, metadata, cookies, and passwords, sending them via Telegram and Discord webhooks.

Our threat research team recently discovered a malicious Maven package impersonating “XZ for Java”. As you may remember, the widely depended on XZ Utils compression library fell prey to a sophisticated social engineering attack, which allowed an attacker to sneak in malicious code earlier this year.

We detected a malicious npm package, solana-systemprogram-utils, targeting the funds of Solana developers. The package reroutes 2% of transactions to an attacker's hardcoded address. Always audit your libraries and rely on trusted sources.

Open source maintainers getting funding directly for security? Yes, please. With LLMs pumping out more code than ever, putting security first in OSS isn’t optional. Awesome to see the recently announced GitHub Secure Open Source Fund, established by GitHub together with >12 partner institutions.

At the start of this week, Anthropic released the Model Context Protocol (MCP), an open standard for connecting AI assistants to data sources like databases, content repositories, and dev environments. It's aiming to solve a key challenge: giving AI models access to real-world data.

Interesting findings about "ghost engineers", but they invite some skepticism. Measuring developer productivity is notoriously challenging—commit counts and hours logged rarely capture true impact.