New research: We’re seeing more packages designed to trip up AI malware scanners. This new package uses prompt-injection-style comments, safety-triggering content, context flooding, and obfuscated JS to probe where scanners refuse, truncate, or miss the code that matters. socket.dev/blog/npm-pac...

🔥 Socket Firewall is now built into Replit's AI-powered development experience. It’s already blocking 8K malicious packages/day across builders on the platform, giving Replit users stronger protection by default at the moment dependencies are introduced. socket.dev/blog/socket-...

npm accidentally marked a bunch of one-character packages as security holders, including c, i, n, x, several numbers, and even the - package. The registry confirmed it was a tooling bug and said a rollback is underway. socket.dev/blog/npm-too...

npm nuked every granular access token that bypasses 2FA after another Mini Shai-Hulud wave compromised hundreds of packages. Good news: staged publishing is now in public preview. socket.dev/blog/npm-inv... #NodeJS #JavaScript

Socket raised a C round! (Maybe we should be SoCket now! ok eeew no) All I can see on my part is that I've been having an awesome time working on AI and with AI, detection, and what not. Lucky to be part in the right place at the right time :D bsky.app/profile/fero...

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

Today's "Mini Shai-Hulud" supply chain attack is a wild evolution! 1. Cascading, cross-ecosystem propagation (PyPi ➡️ npmjs ➡️ Packagist) 2. Using a JS runtime (Bun) to infect Python and PHP 3. Impersonates Claude in git commits to hide in plain sight 🧵

We’re tracking 73 Open VSX sleeper extensions tied to the GlassWorm campaign, with at least 6 already activated to deliver malware. These cloned extensions initially appear benign, then later become malware delivery vehicles through normal updates. socket.dev/blog/73-open...

🚨 Breaking: Namastex Labs, the team behind Automagik[.]dev, hit with a supply chain attack affecting its npm packages. The malicious versions replicate TeamPCP-style Canister Worm tradecraft, including secret theft, exfiltration, and self-propagation. socket.dev/blog/namaste...

Goosonomics (noun) 🪿 A hypocritical corporate strategy of extracting immense financial value from unpaid, open-source labor, only to later declare OSS "dead" or untrustworthy to justify forking, rebuilding, and rebundling that exact same software as a premium, "safe" product.

"Docker Hardened Images for Node.js, Python, and Rust also include Socket Firewall, which blocks malicious dependencies at install time." Another tool for securing your build pipeline - DHI are free and open source: socket.dev/blog/socket-...

North Korea is targeting npm maintainers. Not for crypto. For write access to packages downloaded trillions of times a year. Lodash. Fastify. axios. mocha. Node.js core. Even @feross.bsky.social and several @socket.dev engineers! socket.dev/blog/attacke...

We’re seeing cases where teams can’t explain how they were compromised by the Axios incident because it doesn’t show up in their project's lockfile. The blast radius here is much larger than it looks. Deep dive into the messy reality of modern dependency resolution → socket.dev/blog/hidden-...

The axios compromise blast radius is much much much bigger than people seem to suspect. The secret: transitive dependencies with open ranges making it extremely obscure and difficult to detect whether you were affected, after the fact.

⚠️ If you're running local mcp servers, you need to do the following: 1. Individually "install" packages you want to use, within a specified directory: (e.g. $HOME/mcp) creating a lockfile 2. Add: "--include-workspace-root --workspace $HOME/mcp --no --offline" to EVERY npx call

📢 ZERO SIGN UP, FREE FOREVER, MALWARE PROTECTION. npm i -g sfw sfw npm install sfw pnpm install sfw yarn install sfw cargo fetch sfw uv pip install socket.dev/blog/introdu...

sigh.

🚨 NOT AN EARLY APRIL FOOLS! 🚨 Active supply chain attack on [email protected]. The latest version pulls in [email protected] -- a brand-new package that didn't exist before today! If you use axios, pin your version and audit your lockfile. Socket's Analysis: socket.dev/blog/axios-n...

This is an important situation for every security tool and open source project to monitor right now. cc: @campuscodi.risky.biz @thehackernews.bsky.social @bleepingcomputer.com @techcrunch.com @zackwhittaker.com

These tools are secret + infrastructure + code security scanners by design and used in critical enterprise workflows. If compromised, they risk exposing production environments' secrets with a direct view into where the weak points are. socket.dev/blog/teampcp...

GitHub Actions considered malicious, everybody move back to Jenkin! 🙈 "GitHub’s architecture makes fork commits reachable by SHA from the parent repo" 🚨 amazing breakdown by Rose Security 👏 rosesecurity.dev/2026/03/20/t... #trivy #github #actions #sca #supplychain #security

🚨 AquaSecurity's private source code seems to be fully compromised and in the open, released by the attackers today to github.com/aquasec-com The leak includes private keys credential scripts in the exposed repos. All repos have description: "TeamPCP Owns Aqua Security."

In less than 6 months, companies shipping software in Europe face the first Cyber Resilience Act deadline. ENISA's latest advisory on secure package manager use spells out expectations for SBOMs, dependency monitoring, and vulnerability reporting. socket.dev/blog/enisa-t...

⚠️ UPDATE: we're now tracking 213+ affected package artifacts across this campaign! socket.dev/supply-chain...

🚨 VSCode & OpenVSX users, take note: The "GlassWorm" campaign has evolved to weaponize the very structure of your IDE Extensions. The @socket.dev Research Team just uncovered over 73 new malicious OpenVSX extensions. Read the full technical breakdown + IOCs on our blog socket.dev/blog/open-vs...

Join @socket.dev + @cloudflare.social in a livestream NOW discussing #SANDWORM_MODE the Shai-Hulud-Style npm Worm Hijacking CI Workflows and Poisoning AI Toolchains www.youtube.com/watch?v=OQ6w...

The @socket.dev team caught super early signals of this attack campaign leading to preemptive shutdown! proud of the team and our advanced threat detection engine! 💪 Thankful for the rapid response and takedown @npmjs.bsky.social @github.com @cloudflare.social 🙏 #shaihulud #SANDWORM_MODE

Incoming news. Stay tuned.

Really cool to see @npmjs.bsky.social featuring more security information on package pages, including a link to Socket's analysis! 🤩 Here's what you'll find when you click through → socket.dev/blog/socket-... #NodeJS #JavaScript

New Research: Malicious Chrome extension targets Meta Business Suite/Facebook Business Manager, steals TOTP 2FA seeds + codes, and exfiltrates Business Manager exports (People + analytics). Full analysis: socket.dev/blog/malicio...

🚀 Socket Launch Week Day 3: We’re launching supply chain attack campaign tracking in the Socket dashboard!

Add this episode to your podcast listening queue during the holidays. 🎧 Socket CTO @ahmadnassri.com talks through practical AI coding workflows, where AI actually helps teams today, and why the biggest shifts are being driven by economics. socket.dev/blog/enginee...

Congrats @docker.com! This is the right move for the ecosystem. In case you missed this detail: with Docker Hardened Images teams get secure application dependencies by default. @socket.dev Firewall is built in.

🚀 Big News! Docker Hardened Images are now free! We’re partnering with @docker.com to bundle Socket Firewall into supported images, adding supply chain protection during dependency installs and builds. Details → socket.dev/blog/socket-...

We’re partnering with @docker.com to make software development safer for everyone! Socket Firewall Free is now bundled into Docker Hardened Images, adding build-time and dependency-install supply chain protection for @nodejs.org, @python.org, and @rust-lang.org socket.dev/blog/socket-...

🎁 The Nightmare Before Deployment socket.dev/blog/supply-...

🎙️ Why great products don't always win: Socket CEO @feross.bsky.social breaks down a hard truth for technical founders in this conversation with Vlad Kachur on scaling a security company. Check out the full interview → socket.dev/blog/scaling... #appsec #infosec

Shai-Hulud Déjà vu! 🚨 new wave of supply chain attacks hits npm, impacting widely used packages from AsyncAPI, ENS, Postman, PostHog, and Zapier. socket.dev/blog/shai-hu...

🚀 Big news for JavaScript teams: Socket now supports Bun and vlt in beta. You no longer have to choose between innovation and security. Commit a bun.lock or vlt-lock.json and Socket gives you full supply chain protection.

Launch Week Day 3: We're announcing beta support for @bun.sh and @vlt.sh package managers in Socket! 🎉 Developers using emerging JavaScript package managers can now rely on Socket for full supply chain security, dependency graph analysis, and accurate SBOMs.

Check out Socket CTO @ahmadnassri.com at @workos.bsky.social' Enterprise Ready Conf: Ahmad joined a panel discussing how enterprise security is adapting, as AI speeds up both software development and attacks targeting developer machines. socket.dev/blog/how-ent...

nothing beats a Syrian breakfast 🤤 @ Damaski Palace maps.app.goo.gl/NWZatN3mgves...

🚀 Socket Launch Week Day 5! Malicious packages are infiltrating development environments before they ever reach production. Today we're answering these threats with the release of Socket Firewall Enterprise: configurable, enterprise-grade protection for modern package ecosystems.

1️⃣ AI models aren’t just math -- they’re code. And just like npm or PyPI, they can get hacked. Today we’re launching malware scanning for the Hugging Face ecosystem. 🤖🔍 Socket can now detect backdoors and malicious payloads inside AI models themselves. 👇 www.youtube.com/watch?v=9FQy...

for better security: I use 1password cli with direnv to dynamically load env values (ssh keys, tokens, secrets, etc ...) AWS outage -> 1password thinks it's offline -> can't run anything locally which requires secrets🥲

Recognition for Sarah! So deserved! @sarahgooding.bsky.social

Join me next week at the @workos.bsky.social Enterprise Ready Conf. will be speaking on a panel on all things security & how developers can take back control of their software supply chain. If you're attending, lchat with me & the @socket.dev team IRL! enterprise-ready.com

@bun.sh users can now install any package with confidence, knowing that @socket.dev got their back! Free from malicious packages, typosquatting, and other supply chain attacks. socket.dev/blog/socket-...

Supply chain attacks are evolving and so should your security practices. case-in-point: Beamglea - a campaign that turns npm 💔 into a phishing-as-a-service platform This isn't your typical supply chain attack. It's infrastructure weaponization. socket.dev/blog/175-mal...

Happy to share I'm getting back to my roots in open source, this time around on the side of protecting software development! If you haven't yet, you should install @socket.dev for your team!