Had a SUPER fun conversation on @LogRocket about the huge npm supply chain attacks we've seen over the past 2 months I walked through the whole sorry saga from beginning to end. Don't miss it!

🚨 New twist in the npm malware wars: Socket just uncovered a malicious package, fezbox, that hides its payload inside a QR code image. Yes, you read that right. JavaScript malware using QR code steganography to steal browser cookies & passwords ⬇️ Technical detail below socket.dev/blog/malicio...

DJ Khaled on compromised NPM packages

🚨 Update: The "Shai-Hulud" supply chain attack has expanded to nearly 500 trojanized npm packages, including several from CrowdStrike, all using the same malware first seen in Tinycolor. Full details and package list: socket.dev/blog/ongoing... #NodeJS #JavaScript

Breaking kayfabe to say that Feross & crew are fucking killing it right now, and are doing a way better job than npmhubsoft at keeping people informed in our new "all supply chain attacks all the time" phase of existence.

There has been another serious npm supply-chain attack. Astro is NOT AFFECTED as it does not depend on any of the packages, either directly or indirectly. You should still check your package lock files to ensure you do not have them installed. socket.dev/blog/tinycol...

i like how the npm ecosystem works in general (packages are good) but if you deal with it regularly you should probably code in a vm or a clean operating system with no sensitive tokens

Y'all this is non-stop. 😰 Woke up to another npm supply chain attack this morning. This malware is identical to the one that hit 40+ packages yesterday: cc: @campuscodi.risky.biz

This is not over. 👇 🚨 A new wave of the npm supply chain attack just hit again. This time targeting CrowdStrike packages. Socket detected malware-laced updates that steal developer creds, spin up rogue GitHub Actions, and exfiltrate secrets. Developing story...

🚨 Major active supply chain attack just hit npm. Popular package @​ctrl/tinycolor was trojanized — and it didn’t stop there. Over 40 packages were silently modified to steal secrets from dev machines & CI pipelines. Our team at Socket caught it. Full report coming soon. Stay safe out there.

🚨 Malicious update to @ctrl/tinycolor on npm is part of an active supply chain attack hitting 40+ packages across multiple maintainers. Audit & remove affected versions. Our analysis of the malware: socket.dev/blog/tinycol... #NodeJS #JavaScript

The reason that javascript has semicolons is because newlines are invisible, so the compilers couldn't see the ends of the statements. Then around 2016 computer vision got good enough that we could drop them though.

🚀 It's Day 2 of Socket Launch Week! We’re excited to introduce Tier 1 Reachability: our most precise #CVE triage yet. It cuts out ~80% of irrelevant alerts so you can stop drowning in CVEs.

🎙️ Socket CEO @feross.bsky.social was on the @riskybusiness.bsky.social podcast today. They discussed the recent npm phishing attacks, their limited impact, and the risks if attackers get smarter. Check out the full segment on our blog: socket.dev/blog/risky-b... #cybersecurity #NodeJS

🚀 Day 3 of Socket Launch Week: Announcing Socket Fix 2.0! We updated Socket Fix to be much more powerful, with targeted CVE remediation and broader ecosystem support to help developers get to zero alerts faster. This is available for all Socket users today!

Hackers just hijacked npm packages with 2–3 billion weekly downloads. All that access… and they only stole $500 of crypto 🤯 Sloppiest supply chain attack ever. But if they’d been smarter? Could’ve been catastrophic. I broke it down on @riskybusiness.bsky.social. Full video here 👇

🚨 New research: North Korea’s Contagious Interview campaign is back, with 67 new malicious npm packages, a new malware loader (XORIndex), and 17K+ downloads. Details, IOCs, and full package list → socket.dev/blog/contagi... #javascript #nodejs #infosec

LLMs appear to understand concepts... but can’t apply them. They ace the test, then flunk the follow-up. They’re not “hallucinating” -- they’re faking understanding. New research from Harvard, MIT & UChicago argues that this isn’t intelligence. It’s a convincing facade.

1/ We just caught four malicious npm packages trying to drain your crypto wallet. Obfuscated code. Russian email. Hardcoded wallet. Designed to steal up to 85% of your ETH or BNB — silently. 👇 Here’s how they did it & why it matters 🧵

1/ TC39 has spoken. ✅ Array.fromAsync ✅ Error.isError ✅ using + Symbol.dispose All conditionally approved for Stage 4. That means they’re headed for the official ECMAScript spec. Time to delete some boilerplate.

Auto merge and test checker is soo vital for reducing friction; asking customers what they use Socket for and security teams are always trying to both reduce friction and speed up fixes.

📍 New developments in the #CVE Program saga as CISA states “there was no funding issue” while former Director Jen Easterly questions the transparency of the new CVE Foundation formed by a subset of current CVE Board members. socket.dev/blog/cisa-re... #cybersecurity

Super excited to share what I've been working on lately. Socket can now automagically fix security alerts with an autopilot mode ⚡🪄📦

Bye-bye, Miss Malicious PyPI -- By me @forbes.com: What happens when trust + trust = danger. #kudos @socket.dev #infosec www.forbes.com/sites/daveyw...

We’ve redesigned the Socket dashboard overview! Get clearer insights into your organization's supply chain security with new visuals, alerts, and stats at a glance. 📈 Check it out: socket.dev/blog/new-ove...

🚨 Socket researchers investigate a malicious PyPI package disguised as a #Discord debugger. The attacker used it to deliver a remote access trojan (RAT), and it was downloaded over 11,000 times before removal. Full analysis from the Socket team → socket.dev/blog/malicio... #Python

🚨 The Socket Threat Research Team has discovered a set of malicious npm packages targeting macOS developers using the Cursor AI code editor. They steal credentials, disable updates, and add a persistent backdoor to the IDE. socket.dev/blog/malicio... #JavaScript #CursorAI

The latest AI grift: fake security reports on bug bounty platforms. The reports include vague repro steps, imaginary functions, and nonsense patches. One landed in curl’s inbox - @bagder.mastodon.social.ap.brid.gy & team quickly identified it as AI slop. socket.dev/blog/ai-slop...

🚨 Socket researchers discovered an npm package targeting #crypto traders. It hunts for wallet keys & #BullX credentials, then exfiltrates them via Telegram. A second package serves as a minimal wrapper to execute the payload. Full report → socket.dev/blog/malicio... #JavaScript

CISA has quietly killed off its RSS feeds for KEVs and cyber alerts, replacing an open, automation-friendly format with email and social media alerts. A small change with big consequences for threat monitoring tools that relied on RSS: socket.dev/blog/cisa-ki...

🛠️ ESLint continues its journey to language-agnostic linting, now officially supporting HTML! This new integration brings 48 rules for best practices, accessibility, SEO, and more. Learn more → socket.dev/blog/eslint-... @eslint.org #HTML

🤖 The MCP community just announced work on an official metaregistry to standardize AI tool discovery. It will enable agents to dynamically find & install MCP servers, a game-changer for autonomous systems that can extend their capabilities on demand. Learn more → socket.dev/blog/officia...

When @socket.dev says they are "launching something new every day this week", they're not messing about. Congratulations to @feross.bsky.social & team on acquiring Coana. socket.dev/blog/socket-...

Socket is an excellent option for security on many levels and imho it just got a whole lot better. #secops #security #CyberSecurity

Feross and team are the real deal. They are aiming squarely at one of the most painful and dysfunctional parts of modern development, and continue doing great work to help developers deal with it.

Very stoked for this - most transitive CVEs in the npm ecosystem are false positives due to this very problem, and it creates a lot of costly noise and burden for OSS maintainers.

I once told @feross.bsky.social reachability analysis in JS is impossible. Luckily, we're in the business of doing impossible things for security!

We just bought a company. Why? Because vulnerability scanning is fundamentally broken. And I’m tired of pretending it’s fine. We acquired Coana, the best reachability analysis engine on the planet.

Nordic research 👌

This acquisition is a major milestone in our journey to help organizations build securely with open source. 💜 Get ready for a massive expansion of Socket’s reachability capabilities in the coming months!

Every supply chain + code reachability = a total easy button for any team trying to manage code including the packages outside their own.

We just bought a company. Why? Because vulnerability scanning is fundamentally broken. And I’m tired of pretending it’s fine. We acquired Coana, the best reachability analysis engine on the planet.

🔥 DAY 2 OF @socket.dev LAUNCH WEEK! 🔥 You’ve got 200+ repos 🤯 across 6 teams 👥, 4 languages 💻, and 2 decades of code history 🦖. And you’re still stuck with one blanket security policy? 🤡 Not anymore. Introducing: Repository Labels 🏷️ + Label-Based Security Policies 🛡️👇 socket.dev/blog/introdu...

🔥 LAUNCH WEEK IS HERE! 🔥 We're dropping something new EVERY DAY ahead of BSidesSF + RSAC. Buckle up. 🚀 First out of the gate: Socket now supports .NET 🛡️ Secure your NuGet dependencies from malicious attacks, typosquatting, more—WITHOUT slowing down your builds. socket.dev/blog/introdu...

🎮 INCREDIBLE #TypeScript achievement: Michigan TypeScript founder Dimitri Mitropoulos (@MiTypeScript) has gotten Doom running purely in TypeScript's type system! 177 TB of types processed over 12 days just for the first frame.🤯 socket.dev/blog/typescr...

The latest development in @deno.land's petition to cancel Oracle’s claim to the #JavaScript trademark: Oracle used Node.js as proof of use & is seeking to dismiss fraud claims, delaying the case and avoiding questions about its right to the name. socket.dev/blog/oracle-... #NodeJS

🚨 Socket researchers have discovered a malicious npm package "postcss-optimizer" that delivers BeaverTail malware, targeting developer systems; similarities to past campaigns suggest a North Korean connection. socket.dev/blog/north-k... #cybersecurity #javascript

PyPI confirms no security flaws were exploited in the Ultralytics supply chain attack and the team is working on two new efforts to nudge developers towards more secure publishing configurations. socket.dev/blog/pypi-on... #Python @pypi.org @python.org

Wow. ANOTHER attack targeting the XZ library

🚨 A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular #Solana web3.js library. The injected code captures private keys and transmits them to a hardcoded address. This is a developing story. socket.dev/blog/supply-... #crypto #cybersecurity