Recently went on @changelog.com to talk about the wild surge of npm supply chain attacks… and what developers can actually do to stay safe 🔥 We broke down the real, practical steps every team should take: • Lockfiles matter more than people think • Delay new package versions to dodge fresh malware

Today, we’re launching Socket Firewall Enterprise — built to stop malicious packages before they ever reach your apps or developer systems.

You’d never clone a random repo and give it your production keys… But that’s literally what your GitHub Actions do every time they run. Think about it — your GitHub Actions pipeline pulls in random code straight from the internet, runs it with full access to secrets, tokens, everything.

Security shouldn’t require duct-taping scanners together. Today we’re launching Socket Basics — one platform for: 🧠 Static analysis 🔑 Secrets detection 🐳 Container scanning 🧩 CVE checks All built on proven open source tools. One setup. One dashboard. Zero noise. www.youtube.com/watch?v=WZEV...

1️⃣ AI models aren’t just math -- they’re code. And just like npm or PyPI, they can get hacked. Today we’re launching malware scanning for the Hugging Face ecosystem. 🤖🔍 Socket can now detect backdoors and malicious payloads inside AI models themselves. 👇 www.youtube.com/watch?v=9FQy...

This week we released Socket Firewall, a free CLI tool that protects developers from malicious packages at install time. We're excited to extend protection beyond npm to other ecosystems like #Python and #Rust, with more rolling out soon! @thisweekinrust.bsky.social @campuscodi.risky.biz #rustlang

This is a big 1deal. If you know any software devs, they might want to know about this.

Recognition for Sarah! So deserved! @sarahgooding.bsky.social

Discord = free, fast, and now a favorite for malware C2. We found malicious packages across npm, PyPI, and RubyGems that use hard-coded Discord webhooks to siphon: 😏 secrets (.env, config files) 😵 host data (/etc/passwd), and 😶‍🌫️ phone-home at install time ⬇️ Get the details

North Korea’s “Contagious Interview” campaign continues to weaponize npm: 338 malicious packages, 50K+ downloads. Leveraging typosquats, loader tweaks, and new aliases, it targets #crypto devs and job seekers via recruiter lures. Full Report → socket.dev/blog/north-k... #NodeJS

1/ 🚨 NEW NPM MALWARE CAMPAIGN. Yes, another. North Korea’s “Contagious Interview” campaign is escalating: 338 malicious npm packages, 50,000+ downloads -- 25 still live. Aimed at Web3/crypto devs & job seekers via slick recruiter DMs → git clone → npm install → compromise.

1/ 🚨 We just found a massive abuse of the npm ecosystem: • Targeting 135+ orgs worldwide 🤯 • 175 malicious npm packages (26k+ downloads) • 630+ HTML lures • Weaponized unpkg as free CDN hosting for credential-phishing attacks 👀 More details ⬇️⬇️⬇️

🚨 Another major npm supply-chain attack just hit — and it’s a wake-up call for anyone building on open source. I join @nodeland.dev — creator of Fastify, Node.js core maintainer, and an open-source legend — and Luca Maraschi to break down how attackers are infiltrating npm.

🐍 New on the blog: PEP 810 adds 'lazy import' syntax to defer module loading until first use, cutting startup time by 50–70%. Already sparking debate: an HN thread hit 350+ points and ~200 comments in <24 hrs. #Python Read More → socket.dev/blog/pep-810-proposes-explicit-lazy-imports-for-python-3-15

🎙️ Socket CEO @feross.bsky.social breaks down the recent npm attacks on the PodRocket podcast: phishing campaigns, AI-weaponized exploits, the Shai-Hulud worm, GitHub Actions flaws, and more. Essential listening for JS devs concerned about supply chain security in 2025. socket.dev/blog/podrock...

This is freaking amazing. Folx at @socket.dev are magical security unicorns #security #secops #dev #SupplyChain #npm

🚨 Open source supply chain attacks are exploding. Starting today, that ends. We’re releasing Socket Firewall — FREE, zero-config, CLI that blocks malware before it lands on your laptop or CI. Just run: npm i -g sfw sfw npm install lodash Works for: npm, yarn, pnpm, pip, uv, and cargo.

Had a SUPER fun conversation on @LogRocket about the huge npm supply chain attacks we've seen over the past 2 months I walked through the whole sorry saga from beginning to end. Don't miss it!

🚨 New twist in the npm malware wars: Socket just uncovered a malicious package, fezbox, that hides its payload inside a QR code image. Yes, you read that right. JavaScript malware using QR code steganography to steal browser cookies & passwords ⬇️ Technical detail below socket.dev/blog/malicio...

DJ Khaled on compromised NPM packages

🚨 Update: The "Shai-Hulud" supply chain attack has expanded to nearly 500 trojanized npm packages, including several from CrowdStrike, all using the same malware first seen in Tinycolor. Full details and package list: socket.dev/blog/ongoing... #NodeJS #JavaScript

Breaking kayfabe to say that Feross & crew are fucking killing it right now, and are doing a way better job than npmhubsoft at keeping people informed in our new "all supply chain attacks all the time" phase of existence.

There has been another serious npm supply-chain attack. Astro is NOT AFFECTED as it does not depend on any of the packages, either directly or indirectly. You should still check your package lock files to ensure you do not have them installed. socket.dev/blog/tinycol...

i like how the npm ecosystem works in general (packages are good) but if you deal with it regularly you should probably code in a vm or a clean operating system with no sensitive tokens

Y'all this is non-stop. 😰 Woke up to another npm supply chain attack this morning. This malware is identical to the one that hit 40+ packages yesterday: cc: @campuscodi.risky.biz

This is not over. 👇 🚨 A new wave of the npm supply chain attack just hit again. This time targeting CrowdStrike packages. Socket detected malware-laced updates that steal developer creds, spin up rogue GitHub Actions, and exfiltrate secrets. Developing story...

🚨 Major active supply chain attack just hit npm. Popular package @​ctrl/tinycolor was trojanized — and it didn’t stop there. Over 40 packages were silently modified to steal secrets from dev machines & CI pipelines. Our team at Socket caught it. Full report coming soon. Stay safe out there.

🚨 Malicious update to @ctrl/tinycolor on npm is part of an active supply chain attack hitting 40+ packages across multiple maintainers. Audit & remove affected versions. Our analysis of the malware: socket.dev/blog/tinycol... #NodeJS #JavaScript

The reason that javascript has semicolons is because newlines are invisible, so the compilers couldn't see the ends of the statements. Then around 2016 computer vision got good enough that we could drop them though.

🚀 It's Day 2 of Socket Launch Week! We’re excited to introduce Tier 1 Reachability: our most precise #CVE triage yet. It cuts out ~80% of irrelevant alerts so you can stop drowning in CVEs.

🎙️ Socket CEO @feross.bsky.social was on the @riskybusiness.bsky.social podcast today. They discussed the recent npm phishing attacks, their limited impact, and the risks if attackers get smarter. Check out the full segment on our blog: socket.dev/blog/risky-b... #cybersecurity #NodeJS

🚀 Day 3 of Socket Launch Week: Announcing Socket Fix 2.0! We updated Socket Fix to be much more powerful, with targeted CVE remediation and broader ecosystem support to help developers get to zero alerts faster. This is available for all Socket users today!

Hackers just hijacked npm packages with 2–3 billion weekly downloads. All that access… and they only stole $500 of crypto 🤯 Sloppiest supply chain attack ever. But if they’d been smarter? Could’ve been catastrophic. I broke it down on @riskybusiness.bsky.social. Full video here 👇

🚨 New research: North Korea’s Contagious Interview campaign is back, with 67 new malicious npm packages, a new malware loader (XORIndex), and 17K+ downloads. Details, IOCs, and full package list → socket.dev/blog/contagi... #javascript #nodejs #infosec

LLMs appear to understand concepts... but can’t apply them. They ace the test, then flunk the follow-up. They’re not “hallucinating” -- they’re faking understanding. New research from Harvard, MIT & UChicago argues that this isn’t intelligence. It’s a convincing facade.

1/ We just caught four malicious npm packages trying to drain your crypto wallet. Obfuscated code. Russian email. Hardcoded wallet. Designed to steal up to 85% of your ETH or BNB — silently. 👇 Here’s how they did it & why it matters 🧵

1/ TC39 has spoken. ✅ Array.fromAsync ✅ Error.isError ✅ using + Symbol.dispose All conditionally approved for Stage 4. That means they’re headed for the official ECMAScript spec. Time to delete some boilerplate.

Auto merge and test checker is soo vital for reducing friction; asking customers what they use Socket for and security teams are always trying to both reduce friction and speed up fixes.

📍 New developments in the #CVE Program saga as CISA states “there was no funding issue” while former Director Jen Easterly questions the transparency of the new CVE Foundation formed by a subset of current CVE Board members. socket.dev/blog/cisa-re... #cybersecurity

Super excited to share what I've been working on lately. Socket can now automagically fix security alerts with an autopilot mode ⚡🪄📦

Bye-bye, Miss Malicious PyPI -- By me @forbes.com: What happens when trust + trust = danger. #kudos @socket.dev #infosec www.forbes.com/sites/daveyw...

We’ve redesigned the Socket dashboard overview! Get clearer insights into your organization's supply chain security with new visuals, alerts, and stats at a glance. 📈 Check it out: socket.dev/blog/new-ove...

🚨 Socket researchers investigate a malicious PyPI package disguised as a #Discord debugger. The attacker used it to deliver a remote access trojan (RAT), and it was downloaded over 11,000 times before removal. Full analysis from the Socket team → socket.dev/blog/malicio... #Python

🚨 The Socket Threat Research Team has discovered a set of malicious npm packages targeting macOS developers using the Cursor AI code editor. They steal credentials, disable updates, and add a persistent backdoor to the IDE. socket.dev/blog/malicio... #JavaScript #CursorAI

The latest AI grift: fake security reports on bug bounty platforms. The reports include vague repro steps, imaginary functions, and nonsense patches. One landed in curl’s inbox - @bagder.mastodon.social.ap.brid.gy & team quickly identified it as AI slop. socket.dev/blog/ai-slop...

🚨 Socket researchers discovered an npm package targeting #crypto traders. It hunts for wallet keys & #BullX credentials, then exfiltrates them via Telegram. A second package serves as a minimal wrapper to execute the payload. Full report → socket.dev/blog/malicio... #JavaScript

CISA has quietly killed off its RSS feeds for KEVs and cyber alerts, replacing an open, automation-friendly format with email and social media alerts. A small change with big consequences for threat monitoring tools that relied on RSS: socket.dev/blog/cisa-ki...

🛠️ ESLint continues its journey to language-agnostic linting, now officially supporting HTML! This new integration brings 48 rules for best practices, accessibility, SEO, and more. Learn more → socket.dev/blog/eslint-... @eslint.org #HTML

🤖 The MCP community just announced work on an official metaregistry to standardize AI tool discovery. It will enable agents to dynamically find & install MCP servers, a game-changer for autonomous systems that can extend their capabilities on demand. Learn more → socket.dev/blog/officia...

When @socket.dev says they are "launching something new every day this week", they're not messing about. Congratulations to @feross.bsky.social & team on acquiring Coana. socket.dev/blog/socket-...