DJ Khaled on compromised NPM packages

⚡️ Follow Socket on Instagram! www.instagram.com/socketsecuri...

Today we’re publishing research on 80 confirmed fraudulent candidates who applied for Socket engineering roles in the past 2 months. They’re part of a coordinated campaign, including suspected North Korean operators, aiming to infiltrate hiring pipelines. socket.dev/blog/fraudul...

"This is the third time in last four weeks we've seen something like this." @socket.dev decipher.sc/2025/09/16/n...

🚨 Update: The "Shai-Hulud" supply chain attack has expanded to nearly 500 trojanized npm packages, including several from CrowdStrike, all using the same malware first seen in Tinycolor. Full details and package list: socket.dev/blog/ongoing... #NodeJS #JavaScript

This is not over. 👇 🚨 A new wave of the npm supply chain attack just hit again. This time targeting CrowdStrike packages. Socket detected malware-laced updates that steal developer creds, spin up rogue GitHub Actions, and exfiltrate secrets. Developing story...

new post from socket about it: bsky.app/profile/sock...

Y'all this is non-stop. 😰 Woke up to another npm supply chain attack this morning. This malware is identical to the one that hit 40+ packages yesterday: cc: @campuscodi.risky.biz

i like how the npm ecosystem works in general (packages are good) but if you deal with it regularly you should probably code in a vm or a clean operating system with no sensitive tokens

🚨 Multiple CrowdStrike packages trojanized in an ongoing npm supply chain attack: This is the same campaign that hit Tinycolor yesterday with identical malware. Full list of compromised packages + mitigations → socket.dev/blog/ongoing... #NodeJS #JavaScript

🚨 Malicious update to @ctrl/tinycolor on npm is part of an active supply chain attack hitting 40+ packages across multiple maintainers. Audit & remove affected versions. Our analysis of the malware: socket.dev/blog/tinycol... #NodeJS #JavaScript

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

Stay safe out there, Rustaceans! 🦀

🚨 A new phishing campaign is hitting crates maintainers, pretending to be from the Rust Foundation and asking for logins. There’s no evidence crates.io is compromised but the emails are convincing and are bypassing Gmail spam filters. socket.dev/blog/crates-... #rustlang

🚀 Socket Launch Week Day 5: Custom PR Alert Headers are here! Add your team's security guidance directly to Socket's PR comments - triage checklists, runbook links, policy context. Right where developers need it. No more repeating the same context across channels.

🚀 Socket Launch Day 4: #Rust Support Is Now in Beta! All users can now scan Cargo projects and generate SBOMs, including Cargo.toml-only crates, with Rust-aware supply chain checks. Detect risky build scripts, FFI risks, and more. 🦀 Try it today. → socket.dev/blog/rust-su...

🚀 Day 3 of Socket Launch Week: Announcing Socket Fix 2.0! We updated Socket Fix to be much more powerful, with targeted CVE remediation and broader ecosystem support to help developers get to zero alerts faster. This is available for all Socket users today!

🎙️ Socket CEO @feross.bsky.social was on the @riskybusiness.bsky.social podcast today. They discussed the recent npm phishing attacks, their limited impact, and the risks if attackers get smarter. Check out the full segment on our blog: socket.dev/blog/risky-b... #cybersecurity #NodeJS

Hackers just hijacked npm packages with 2–3 billion weekly downloads. All that access… and they only stole $500 of crypto 🤯 Sloppiest supply chain attack ever. But if they’d been smarter? Could’ve been catastrophic. I broke it down on @riskybusiness.bsky.social. Full video here 👇

🚀 It's Day 2 of Socket Launch Week! We’re excited to introduce Tier 1 Reachability: our most precise #CVE triage yet. It cuts out ~80% of irrelevant alerts so you can stop drowning in CVEs.

Hi everyone. The 'next day' busy-ness has fully set in. Since I still haven't gotten any followup from npm regarding account actions taken, and given that I have now been approached by authorities, I will need to hold off on the post-mortem for a day or two. Sincerest apologies for the delay.

Updated with new information from @socket.dev about another compromise. decipher.sc/2025/09/08/t...

😱😱 From the DuckDB team: "This website contained a pixel-perfect copy of the npmjs.com website. He logged in using the duckdb_admin user & password, followed by 2FA. Again, the user profile, settings etc. were a perfect copy of the npmjs.com website including all user data."

🚨 BREAKING: The DuckDB npm account was compromised. Malicious versions of duckdb, duckdb-wasm, and more were published early this morning with the same wallet-drainer malware seen in yesterday’s supply-chain attack. Check your dependencies! socket.dev/blog/duckdb-... #NodeJS

📦 The MCP Steering Committee has launched the official MCP Registry in preview, a hub for discovering and publishing MCP servers. MCP server authors publish once, and all clients, aggregators, and subregistries can pull from the same canonical data. Read more ➳ socket.dev/blog/mcp-ste...

🚀 We’re kicking off another Launch Week at Socket, with a new feature launching every day! First up: Pull Request Stories, a dashboard view that helps security teams track supply chain risks by showing the real impact of every PR.

A number of popular npm packages have been compromised and malicious versions published. Most of these have been removed from the registry. Astro indirectly depends on one that hasn't, so we have published 5.13.6 that pins a safe version.

🚨 Breaking: npm author Qix compromised. Malicious package versions published in projects that typically see hundreds of millions of downloads each week. Details: socket.dev/blog/npm-aut...

🚨 Socket’s Threat Research Team found 4 malicious npm packages impersonating Flashbots SDKs, designed to exfiltrate #Ethereum wallet credentials via Telegram. Full breakdown here: socket.dev/blog/malicio... #Web3 #Crypto

🔥 Python's uv has inspired rv for #Ruby: installs precompiled Ruby 3.4.x in ~0.22s and combines version + dependency management in a single Rust-powered tool. socket.dev/blog/rv-is-a... @shortruby.com

We also recently moved @fast-check.dev and all associated packages to Trusted Publishing to ensure a safer publication flow 🤗

The Nx team’s investigation into last week’s supply chain attack found the compromise came from a GitHub Actions workflow injection on an outdated branch, exposing the npm token and enabling malicious publishes. All Nx packages now use Trusted Publishing. 🔐 socket.dev/blog/nx-supp...

🤖 Developers are rallying around AGENTS.md, a fast-emerging standard for giving instructions to AI coding agents. Already adopted in 20k+ repos and now supported by GitHub Copilot. Read more: socket.dev/blog/agents-...

Today on the pod, learn about TS 6.0 breaking changes, Node type stripping migration strategies, Deno's #FreeJavaScript campaign, Nx security PSA, Vitest 4 perf improvements & more! share.transistor.fm/s/56804839 #typescript

🤖 Developers are rallying around AGENTS.md, a fast-emerging standard for giving instructions to AI coding agents. Already adopted in 20k+ repos and now supported by GitHub Copilot. Read more: socket.dev/blog/agents-...

🚨 Socket’s Threat Research Team found a malicious npm package impersonating Nodemailer. It modifies Windows #crypto wallets to redirect transactions to attacker-controlled addresses. socket.dev/blog/wallet-... #nodejs #javascript

🎙️ Scanners overwhelm teams with CVE alerts but most aren’t exploitable. On the Risky Biz podcast, @feross.bsky.social explains how reachability analysis cuts 90% of the noise. This episode is a deep dive into one of the hardest problems in vulnerability management. socket.dev/blog/risky-b...

🚨 If you think you might be effected by the nx compromise please revoke the GitHub CLI Authorized OAuth App: github.com/settings/con... Notably, this is the only way to revoke/rotate the tokens made by/known to that app. The next time you `gh login` you can reauth.

Attackers are now experimenting with weaponizing AI developer tools to accelerate reconnaissance and data theft. By expressing goals in prompts, they skip writing custom code and tap into cross-platform expertise instantly, cutting development time for supply chain attacks.

🚨 Supply chain attack on Nx npm packages (4.6M weekly downloads) Malware abused AI CLI tools (Claude, Gemini, Q) to steal creds + wallets, then exfiltrated to GitHub repos (s1ngularity-repository*). More than 1,000 victim accounts confirmed. 🔗 socket.dev/blog/nx-pack... #nodejs

📢 CISA’s 2025 SBOM guidance moves beyond simple software inventories, adding hashes, licenses, tool metadata & context to make SBOMs operationally actionable. Public comment is open until Oct 3. Read more: socket.dev/blog/cisa-20...

💎 Follow-up and clarification on our recent research into the malicious #Ruby gems campaign: socket.dev/blog/follow-...

ESLint is about to ship parallel linting, closing a 10-year-old feature request. 🚀 Benchmarks show 30–60% faster runs, with some projects seeing 3x+ improvements. Our write-up on the shifting linter landscape: socket.dev/blog/eslint-... @eslint.org

🧹 New linter alert! @rspack.dev introduces Rslint, a TypeScript-first linter in Go powered by typescript-go. Fast, typed, ESLint-compatible, and part of the growing trend of toolchains building their own linters. socket.dev/blog/rspack-... #TypeScript #JavaScript

🚨 A malicious Go module, disguised as an SSH brute-forcing tool, is sending stolen SSH logins to a hardcoded Telegram bot that is still active. Full analysis: socket.dev/blog/malicio... #GoLang

🧹 New linter alert! @rspack.dev introduces Rslint, a TypeScript-first linter in Go powered by typescript-go. Fast, typed, ESLint-compatible, and part of the growing trend of toolchains building their own linters. socket.dev/blog/rspack-... #TypeScript #JavaScript

1Password, Bitwarden, LastPass, Enpass, iCloud Passwords, and LogMeOnce remain vulnerable to zero-day clickjacking vulnerabilities disclosed at DEF CON. Vendors downplayed or ignored the issue. Socket has filed a CVE to ensure these risks are formally tracked. socket.dev/blog/passwor...

Zero-Day Clickjacking Flaws Found in Password Managers Used by Millions

Six major password managers with tens of millions of users are currently vulnerable to unpatched clickjacking flaws that could allow attackers to steal account credentials, 2FA codes, and credit card details.