Socket’s Threat Research Team identified a campaign of 108 Chrome extensions tied to a shared C2 infrastructure. The extensions harvest Google identities, steal Telegram sessions, inject ads, and include browser backdoors. ~20K installs across the Chrome Web Store. socket.dev/blog/108-chr...

"The big things that led us to Socket were: better data quality, higher relevance, and better coverage." - Timothy Smith, Security Engineering Manager, Cedar

Axios supply chain attack reaches OpenAI’s macOS signing pipeline, forcing certificate rotation. No evidence of compromise, but this shows how far a hijacked dependency can travel. socket.dev/blog/axios-s...

Axios supply chain attack reaches OpenAI’s macOS signing pipeline, forcing certificate rotation. No evidence of compromise, but this shows how far a hijacked dependency can travel. socket.dev/blog/axios-s...

Goosonomics (noun) 🪿 A hypocritical corporate strategy of extracting immense financial value from unpaid, open-source labor, only to later declare OSS "dead" or untrustworthy to justify forking, rebuilding, and rebundling that exact same software as a premium, "safe" product.

🪿 There are some wild takes out there right now about open source being “dead” after recent supply chain attacks and rapid advances in AI-driven security. Let’s talk goosenomics for a minute. → socket.dev/blog/dont-ki...

🪿 There are some wild takes out there right now about open source being “dead” after recent supply chain attacks and rapid advances in AI-driven security. Let’s talk goosenomics for a minute. → socket.dev/blog/dont-ki...

"The whole software supply chain is built on blind trust. You're downloading code from random people on the internet that you've never met, and you're like, let's just run it." - @feross.bsky.social on TBPN talking about the Axios compromise. Full interview → socket.dev/blog/feross-...

PSA: Watch out. Attackers are impersonating a Linux Foundation leader in Slack to target open source developers

"The whole software supply chain is built on blind trust. You're downloading code from random people on the internet that you've never met, and you're like, let's just run it." - @feross.bsky.social on TBPN talking about the Axios compromise. Full interview → socket.dev/blog/feross-...

🚀 @socket.dev's first appearance on TBPN. We talked about what's been an intense week in supply chain security and why AI is accelerating the problem. We've been building for exactly this moment. www.youtube.com/watch?v=EeJg...

North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads Socket socket.dev/blog/contagi... @socket.dev

Attackers are impersonating a @linuxfoundation.org leader in Slack to target #opensource developers with a multi-stage attack that ends in malware delivery. @openssf.org issued a high-severity advisory. More details and screenshots of the lure: socket.dev/blog/attacke... #infosec

🔥 Socket CEO @feross.bsky.social is live on TBPN right now discussing the Axios compromise: www.youtube.com/watch?v=BRYr...

🚨 North Korea’s Contagious Interview campaign is now spreading across 5 ecosystems. We found coordinated malicious packages on npm, PyPI, Go Modules, Crates, and Packagist delivering staged RAT payloads that steal credentials, wallets & browser data. socket.dev/blog/contagi...

AI agents are executing code, calling APIs, writing to databases, and most deployments have almost no controls around what they can do. @microsoft.com just open-sourced a runtime governance toolkit built around @owasp.org's Top 10 for Agentic Applications. Details → socket.dev/blog/microso...

"Docker Hardened Images for Node.js, Python, and Rust also include Socket Firewall, which blocks malicious dependencies at install time." Another tool for securing your build pipeline - DHI are free and open source: socket.dev/blog/socket-...

Big thanks to the team at @darkreading.bsky.social for helping bring attention to this coordinated social engineering campaign:

Damn I got this as well! Just assumed it was spam and ignored this (and the LinkedIn follow up) turns out I dodged a bullet 😅

It's absolutely unbelievable the levels of social engineering maintainers have to be alert to these days. Hopefully the general media pick up on @sarahgooding.bsky.social's story to raise awareness more widely. #npm #nodejs #security

📖 This article by @sarahgooding.bsky.social at @socket.dev highlights a concerning trend (ref. socket.dev/blog/attacke...) 📕 Story time: this kind of supply chain targeting isn't unique. I myself & everyone on our team @vlt.sh have been the targets of consistent, concerted efforts.

Developers are in scope attack surface.

This campaign is massive and a great reminder that behind your favorite Open Source dependencies are humans too! I was also targeted, lucky that it takes me years to check my inbox 💀

Look, I’m in the news, like a lot of other maintainers 🤓 Scary stuff this

Wanted to warn the #NodeJS community: This campaign is active. Thank you to the maintainers who shared their stories - some of these came frighteningly close. One got all the way to the fake meeting before walking away. The more we talk about this, the harder it is for these attacks to succeed.

jokes on them, ignoring my inbox has long been part of my security posture

North Korea is targeting npm maintainers. Not for crypto. For write access to packages downloaded trillions of times a year. Lodash. Fastify. axios. mocha. Node.js core. Even @feross.bsky.social and several @socket.dev engineers! socket.dev/blog/attacke...

🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week. socket.dev/blog/attacke...

Most critical OSS projects don’t have independent security budgets, so it's not unusual that even something as central as @nodejs.org depended on pooled funding models like the IBB. If open source consumers want these kinds of security incentives to exist, they need to step up to fund them.

Axios maintainer confirms the npm compromise was caused by a targeted social engineering attack that led to full access to his GitHub and npm accounts. Open source maintainers continue to be high-value targets in supply chain attacks. socket.dev/blog/axios-m...

🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript

📍 @nodejs.org drops bug bounty rewards after external funding dries up. A real hit to its security incentives → socket.dev/blog/node-js... #nodejs #javascript

The axios compromise blast radius is much much much bigger than people seem to suspect. The secret: transitive dependencies with open ranges making it extremely obscure and difficult to detect whether you were affected, after the fact.

this is one of my favorite parts of the @vlt.sh CLI. it uses @socket.dev security data to prevent known malware from running lifecycle scripts like postinstall! and it’s powered by queries under the hood so you could make it as granular as you wanted (but we ship with safe defaults)

⚠️ If you're running local mcp servers, you need to do the following: 1. Individually "install" packages you want to use, within a specified directory: (e.g. $HOME/mcp) creating a lockfile 2. Add: "--include-workspace-root --workspace $HOME/mcp --no --offline" to EVERY npx call

We’re seeing cases where teams can’t explain how they were compromised by the Axios incident because it doesn’t show up in their project's lockfile. The blast radius here is much larger than it looks. Deep dive into the messy reality of modern dependency resolution → socket.dev/blog/hidden-...

🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript

This is a big deal compromise. This package is very popular.

This post appeared under this Techmeme headline:

This kind of attack is getting more and more common. Early in my career I used to update dependencies blindly — not anymore. For a few years now I’ve been locking packages to specific versions, reading changelogs carefully, and setting a `cooldown` in Dependabot (link in thread).

🚨 Active supply chain attack on [email protected]. The latest version pulls in [email protected] -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...

"Open source dependencies should be treated as part of the security perimeter, the systems you are responsible for securing, even if you don’t control them." - @rginn206.bsky.social

🚨 TeamPCP compromised the Telnyx #Python SDK on PyPI. Malicious versions 4.87.1 and 4.87.2 steal credentials. Full analysis → socket.dev/blog/telnyx-...

TeamPCP has partnered with ransomware group Vect after exfiltrating ~300GB of credentials from CI/CD environments, targeting open source supply chains. “We will chain these compromises into devastating follow-on ransomware campaigns.” Details → socket.dev/blog/teampcp...

📌 If you've been tagged in one of these discussions, don’t follow the link. It’s not just spam. There’s routing and browser fingerprinting happening before anything else is served, as a first step before a follow-on payload.

New month, new GitHub bot spam notifications 🙄

🚨 We’re seeing a widespread GitHub campaign using fake VS Code alerts + Google redirects to route developers to attacker infrastructure. The flow adapts based on cookies and fingerprints users before serving a second-stage attack. Not your average phishing link: socket.dev/blog/widespr...

At RSA? Join Docker + Socket.dev for a happy hour. Socket Firewall is now integrated into Docker Hardened Images, helping filter risky dependencies early. Grab a drink and talk directly with the teams behind it. 🗓 March 25 | 4pm PST Register: https://bit.ly/4dFAvAq

We're hiring for our first VP of Engineering at Socket. You'll work directly with @feross.bsky.social to lead and scale a high-performing, deeply technical engineering team tackling some of the hardest problems in software supply chain security. ⚡️Apply here: jobs.ashbyhq.com/socket/09d8b...

These tools are secret + infrastructure + code security scanners by design and used in critical enterprise workflows. If compromised, they risk exposing production environments' secrets with a direct view into where the weak points are. socket.dev/blog/teampcp...