💣 Destructive malware is increasingly showing up in open source packages. Our 2025 report documents sabotage-focused attacks that delete code, break builds, and wipe repos across npm, PyPI, NuGet, and Go. Read the full report ↓ socket.dev/blog/2025-re...

Add this episode to your podcast listening queue during the holidays. 🎧 Socket CTO @ahmadnassri.com talks through practical AI coding workflows, where AI actually helps teams today, and why the biggest shifts are being driven by economics. socket.dev/blog/enginee...

🚨 New research: A spearphishing campaign published 27 malicious npm packages that host browser-run lures mimicking document portals and Microsoft sign-in to steal credentials. This operation targets manufacturing and healthcare orgs in the U.S. and allied countries. socket.dev/blog/spearph...

Chrome extensions are still a wild west ecosystem. This fake “VPN” ran for years and charged users for the privilege of silently intercepting their traffic. cc: @campuscodi.risky.biz @zackwhittaker.com @cisoseries.bsky.social

Don’t trust free VPNs, don’t install joke Chrome extensions. You know what, just don’t install anything at all from now on. And get a new PC.

🚨 Socket’s Threat Research Team uncovered two malicious "Phantom Shuttle" Chrome extensions masquerading as a VPN since at least 2017, intercepting traffic and exfiltrating credentials via attacker-controlled proxies. Full research → socket.dev/blog/malicio...

Free JavaScript security course from @openjsf.org / @linuxfoundation.org training.linuxfoundation.org/training/int...

Congrats @docker.com! This is the right move for the ecosystem. In case you missed this detail: with Docker Hardened Images teams get secure application dependencies by default. @socket.dev Firewall is built in.

🚀 Big News! Docker Hardened Images are now free! We’re partnering with @docker.com to bundle Socket Firewall into supported images, adding supply chain protection during dependency installs and builds. Details → socket.dev/blog/socket-...

🎁 The Nightmare Before Deployment socket.dev/blog/supply-...

This is an extremely convincing typosquat. Also a good reminder that Google’s AI summaries are not a reliable way to determine whether a package is safe to use. 😵‍💫

It's not only NPM.

🥷 In this @softwaredaily.bsky.social episode, @feross.bsky.social talks about the dark side of Chrome extensions getting bought and sold to unknown buyers, a super common supply chain risk most users never see. Check out the full episode → socket.dev/blog/softwar...

🚨 New threat research: An impostor #NuGet package typosquatted a popular .NET tracing library and its author, using homoglyph tricks to blend in, then exfiltrated #Stratis wallet JSON and passwords to a Russian IP address. Full report → socket.dev/blog/malicio... #dotnet

We’re excited to see @deno.land 2.6 ship deno audit plus an experimental --socket flag! 🎉 Catch malicious packages and supply chain attacks before they land: Run deno audit --socket to get free Socket Firewall checks for npm dependencies right in the CLI. socket.dev/blog/deno-2-...

⚠️ Following increased scrutiny after React2Shell, new #React Server Components vulns have been disclosed: high-severity DoS and source code exposure in RSC packages. What’s affected and how to patch → socket.dev/blog/new-rea... #nodejs

🔮 The Myth of Magical Code from the Sky: Modern apps run on mountains of open source code that almost no one is actually reviewing. In this @softwaredaily.bsky.social episode, @feross.bsky.social joins @joshuakgoldberg.com to talk about why that’s so risky. Check it out→ socket.dev/blog/softwar...

🔮 The Myth of Magical Code from the Sky: Modern apps run on mountains of open source code that almost no one is actually reviewing. In this @softwaredaily.bsky.social episode, @feross.bsky.social joins @joshuakgoldberg.com to talk about why that’s so risky. Check it out→ socket.dev/blog/softwar...

Want to work with me and a number of world-class JS open source developers at @socket.dev protecting ALL open source libraries from supply chain attacks? We're looking for stellar frontend developers. DM me

🧨 “Gaps in design and implementation with the new OIDC Trusted Publisher workflows leave maintainers open to novel and increasingly difficult to detect gaps in their publishing setups. We do not recommend critical projects move to this new workflow..." - @notwes.bsky.social

npm has revoked classic tokens for publishing, pushing maintainers toward OIDC trusted publishing or granular tokens. But @openjsf.org warns trusted publishing still has risky gaps for critical projects. What maintainers should do next: socket.dev/blog/npm-rev... #NodeJS #JavaScript

npm has revoked classic tokens for publishing, pushing maintainers toward OIDC trusted publishing or granular tokens. But @openjsf.org warns trusted publishing still has risky gaps for critical projects. What maintainers should do next: socket.dev/blog/npm-rev... #NodeJS #JavaScript

#Rust may soon be adding a built-in Security tab on crates.io to show RustSec advisories (vulns + “unsound APIs”) directly on crate pages. The RFC is in its Final Comment Period → socket.dev/blog/rust-rf... #rustlang cc: @rustaceans.bsky.social @thisweekinrust.bsky.social

Feross Aboukhadijeh is the founder and CEO of @socket.dev. He joins @joshuakgoldberg.com to talk about his career, open source supply chain attacks, practical security lessons, the expanding attack surface in software development, and more. @feross.bsky.social bit.ly/4iMDU14

This typosquat is all fancied up to look legit, seems like the threat actor put in a lot of effort here. We were once again impressed by how fast the crates.io team took it down! 👏 cc: @thisweekinrust.bsky.social @rustaceans.bsky.social @theembeddedrust.bsky.social @campuscodi.risky.biz

🚨 New from the Socket Research Team: Malicious Go packages impersonating Google's UUID library quietly exfiltrate encrypted data to dpaste. Full report → socket.dev/blog/malicio... #golang cc: @campuscodi.risky.biz

📉 November CVE publications fell 25% YoY, but 2025 is still tracking 16.9% higher overall. A reminder from @jgamblin.bsky.social: “global CVE counts” can swing based on a handful of major CNAs and their workflow throughput, so a quiet month is not a risk signal. socket.dev/blog/novembe... #cve

📌 If you got a GitHub permissions update notice from Socket today, we adjusted bot permissions to enable Socket Certified Patches ahead of a wider rollout. This allows Socket to automatically open a PR that commits patch files into your repo when you choose “Patch.” socket.dev/changelog/gi...

🚨 New Socket Threat Research: We found a malicious typosquat targeting Rust devs. The finch-rust crate mimics the legit finch crate but loads a credential-stealing payload and exfiltrates data to rust-docs-build[.]vercel[.]app. Details + IOCs: socket.dev/blog/malicio... #Rustlang

🚨 New from the Socket Research Team: Malicious Go packages impersonating Google's UUID library quietly exfiltrate encrypted data to dpaste. Full report → socket.dev/blog/malicio... #golang cc: @campuscodi.risky.biz

📉 November CVE publications fell 25% YoY, but 2025 is still tracking 16.9% higher overall. A reminder from @jgamblin.bsky.social: “global CVE counts” can swing based on a handful of major CNAs and their workflow throughput, so a quiet month is not a risk signal. socket.dev/blog/novembe... #cve

Malicious Rust packages targeted Web3 developers 📖 Read more: www.helpnetsecurity.com/2025/12/04/m... #cybersecurity #Cybersecuritynews @socket.dev #web3 #Rust

#TypeScript 6.0 will be the last JS-based major release. TypeScript 7’s native toolchain (Corsa) is already testable, with benchmarks showing ~7.5–10x faster full builds. socket.dev/blog/typescr... #JavaScript

🚨 React disclosed a critical (CVSS 10.0) RCE in React Server Components. If you use RSC (often via frameworks like Next.js), upgrade react-server-dom-* to patched versions ASAP. Details → socket.dev/blog/critica... #NodeJS #React

Seasonal nuisance on npm this morning: 420+ auto-generated elf-stats-* packages, many claiming “generated every two minutes,” published from new throwaway accounts. Payloads are simple but unsafe (exfil / preinstall scripts). npm is already removing packages. socket.dev/blog/elves-o... #NodeJS

Major props to the Crates.io team - they removed this crate within just minutes of it being reported. 💪 cc: @campuscodi.risky.biz @thisweekinrust.bsky.social @theembeddedrust.bsky.social @rustaceans.bsky.social @weeklyrust.substack.com.web.brid.gy

🚨 New Socket Threat Research: We found a malicious Rust crate disguised as an EVM version helper that downloads & silently executes OS-specific payloads, likely for crypto theft. The crate was live for 8 months and was swiftly removed after we reported it. socket.dev/blog/malicio... #Rustlang

A reality for anyone scaling a team: "What got you from zero to one is not what's going get you from one to 10. So you have to constantly evolve the way you run your business." - @feross.bsky.social on the Vlad Kachur Show 🧨 Full Interview: socket.dev/blog/scaling...

🎙️ Why great products don't always win: Socket CEO @feross.bsky.social breaks down a hard truth for technical founders in this conversation with Vlad Kachur on scaling a security company. Check out the full interview → socket.dev/blog/scaling... #appsec #infosec

The Socket Threat Research Team continues to track North Korea’s Contagious Interview operation as it systematically infiltrates the npm ecosystem. socket.dev/blog/north-k... @socket.dev

New research from Socket: We uncover how North Korean hackers are using npm, GitHub, and Vercel together to spread OtterCookie malware, adding 197 malicious npm packages. socket.dev/blog/north-k... #JavaScript #malware

More malicious Chrome extensions. Stay vigilant!

🚨 Socket researchers uncovered a malicious Chrome extension that injects hidden #SOL transfers into Raydium swaps, quietly siphoning fees to an attacker wallet. Full analysis → socket.dev/blog/malicio... #Solana

Update: at time of writing Eleventy core (0.x, 1.x, 2.x, 3.x, 4.x prereleases) and our official plugins are still unaffected. (Compromised package count was updated to 834 from 533 in the latest @socket.dev update)

⚠️ Major Update on the Shai Hulud v2 campaign: We’ve confirmed 834 malicious packages and now see spillover into Maven Central. The package org.mvnpm:posthog-node:4.18.1 contains the same Bun-based payload used in the npm compromise. Updated analysis → socket.dev/blog/shai-hu... #Java

that’s a scary read tbh

🤯 The number of affected packages in the Shai-Hulud npm attack has now reached 770. We’re continuing to investigate and will keep the blog post updated: socket.dev/blog/shai-hu...

🚨 check your dependencies! in these 500+ packages, three third-party nuxt modules were affected: - @alexcolls/nuxt-ux - @alexcolls/nuxt-socket.io - @posthog/nuxt no dependencies of nuxt itself, or any of our first party modules, were affected.

We have updated this list to include more than 500 packages and 700+ affected versions, as well as a technical analysis of the attack. socket.dev/blog/shai-hu.... cc: @campuscodi.risky.biz @typescript.fm @bleepingcomputer.com @theregister.com

We're currently tracking more than 500 unique packages and 700+ affected versions. We'll update the post as our investigation continues.