Thrilled to have Jordan joining us at @socket.dev! 💜

This is wild. 99% of the code is legit, with just 20 malicious lines buried in thousands of lines of working code. cc: @campuscodi.risky.biz

Five practical steps to stay safe on npm @sarahgooding.bsky.social @socket.dev socket.dev/blog/the-cha... #ECMAScript #JavaScript

‼️ Update: the MIT-linked “AI-powered ransomware” report appears to have been taken offline. We updated our article to include an Internet Archive link to the original paper.

Still installing npm packages like it’s 2020? Not all npm installs are treats. 🎃 On the @changelog.com podcast, @feross.bsky.social shares practical steps every developer should take to reduce exposure to supply chain attacks on npm. → socket.dev/blog/the-cha... #NodeJS #JavaScript

That MIT report is absolutely bonkers btw - it classifies 80% of ransomware groups as using GenAI (made up btw), then says things like Emotet uses AI (what? It’s a banking trojan from years ago), Ryuk uses AI (?!?!) etc etc. And it’s published via MIT with their chief security persons name on it.

This is really well written, if you want to scare your CISO, send them this for Halloween. 🎃

There’s a real conversation to be had about how AI has found real-world use cases across cybercrime, but there’s no way in heck that “80 percent of ransomware attacks are AI-driven,” as this report claims. 🤑 h/t @doublepulsar.com cc: @campuscodi.risky.biz

Some fairly convincing typosquats in this campaign - a reminder that typosquatting is still an effective attack vector on npm. cc: @campuscodi.risky.biz

This is a wild typosquat hiding #NuGet malware: cc: @campuscodi.risky.biz

Can you believe it – we’re kicking off another Socket Launch Week! 🎉 We'll be announcing a new feature every day. And we’re starting big: Today we're introducing malware scanning for the Hugging Face ecosystem! #HuggingFace

Wow! I'm honored to receive this award from the @openjsf.org. It's a privilege to share stories that highlight the people and projects driving open source security forward. I'm thankful my work at @socket.dev lets me support the OSS maintainers and users at the heart of this community. 💜

More malicious packages linked to North Korea, leveraging typosquatting. Targets include Web3, cryptocurrency, and blockchain developers, as well as technical job seekers approached with recruiting lures, leading to multi-stage compromise and financial loss. cc: @campuscodi.risky.biz

Ruby Central’s incident report on the RubyGems.org access dispute sparks community backlash and renewed debate over project governance. An overview on the latest news from the Ruby gems packaging ecosystem with comments from @indirect.io and @duckinator.bsky.social:

Big change in Google’s OSV that hasn’t gotten much attention: 500+ advisories just reappeared after a policy fix that had been hiding disputed CVEs. cc: @campuscodi.risky.biz

Introducing Socket Firewall: free, proactive protection for your software supply chain @dale.link @socket.dev socket.dev/blog/introdu... #ECMAScript #JavaScript

Thrilled to have @ahmadnassri.com joining us at Socket! 🎉🎉🎉

🔥 Breaking: Former #RubyGems maintainers have launched the Gem Cooperative, a community-run RubyGems server with open governance. We spoke with the team behind it. Read the full story on the Socket blog
→ socket.dev/blog/gem-coo... #RubyLang #Ruby #Rails

This week we released Socket Firewall, a free CLI tool that protects developers from malicious packages at install time. We're excited to extend protection beyond npm to other ecosystems like #Python and #Rust, with more rolling out soon! @thisweekinrust.bsky.social @campuscodi.risky.biz #rustlang

Excited to see The Register cover the launch of Socket Firewall! This new free tool gives developers real-time protection at install time across multiple ecosystems, including JavaScript, Python, and Rust, with more coming soon. It works out of the box: No API key. No configuration.

Other than the trusted publishing stuff (which is absolutely not ready for use yet, I will be outlining why in my JS Conf talk) this is a great write up of the recent goings on.

⚡️ Follow Socket on Instagram! www.instagram.com/socketsecuri...

…what a time to be in the JavaScript web security space…

🚨 Update: The "Shai-Hulud" supply chain attack has expanded to nearly 500 trojanized npm packages, including several from CrowdStrike, all using the same malware first seen in Tinycolor. Full details and package list: socket.dev/blog/ongoing... #NodeJS #JavaScript

the ecosystem can’t keep absorbing hits like this, we need stronger defenses

Y'all this is non-stop. 😰 Woke up to another npm supply chain attack this morning. This malware is identical to the one that hit 40+ packages yesterday: cc: @campuscodi.risky.biz

🚨 Major active supply chain attack just hit npm. Popular package @​ctrl/tinycolor was trojanized — and it didn’t stop there. Over 40 packages were silently modified to steal secrets from dev machines & CI pipelines. Our team at Socket caught it. Full report coming soon. Stay safe out there.

These attacks used to be more rare, but now we're seeing popular packages getting compromised every week. Check your dependencies. cc: @campuscodi.risky.biz

After recent npm supply chain attacks, @pnpm.io 10.16 adds a setting for delayed dependency updates. Tools like Taze and npm-check-updates are testing similar “maturity” options, hinting at a cautious new trend in #JavaScript package management. socket.dev/blog/pnpm-10... #NodeJS

🚨 A new phishing campaign is hitting crates maintainers, pretending to be from the Rust Foundation and asking for logins. There’s no evidence crates.io is compromised but the emails are convincing and are bypassing Gmail spam filters. socket.dev/blog/crates-... #rustlang

🚀 Day 3 of Socket Launch Week: Announcing Socket Fix 2.0! We updated Socket Fix to be much more powerful, with targeted CVE remediation and broader ecosystem support to help developers get to zero alerts faster. This is available for all Socket users today!

Hackers just hijacked npm packages with 2–3 billion weekly downloads. All that access… and they only stole $500 of crypto 🤯 Sloppiest supply chain attack ever. But if they’d been smarter? Could’ve been catastrophic. I broke it down on @riskybusiness.bsky.social. Full video here 👇

😱😱 From the DuckDB team: "This website contained a pixel-perfect copy of the npmjs.com website. He logged in using the duckdb_admin user & password, followed by 2FA. Again, the user profile, settings etc. were a perfect copy of the npmjs.com website including all user data."

🚨 BREAKING: The DuckDB npm account was compromised. Malicious versions of duckdb, duckdb-wasm, and more were published early this morning with the same wallet-drainer malware seen in yesterday’s supply-chain attack. Check your dependencies! socket.dev/blog/duckdb-... #NodeJS

🚀 We’re kicking off another Launch Week at Socket, with a new feature launching every day! First up: Pull Request Stories, a dashboard view that helps security teams track supply chain risks by showing the real impact of every PR.

🚨 Breaking: npm author Qix compromised. Malicious package versions published in projects that typically see hundreds of millions of downloads each week. Details: socket.dev/blog/npm-aut...

I've been building around WordPress to create a social network based on RSS. I want to get out of being controlled by billionaire-owned sites. I have a feeling we may need a good backup given where we are now.

🔥 Python's uv has inspired rv for #Ruby: installs precompiled Ruby 3.4.x in ~0.22s and combines version + dependency management in a single Rust-powered tool. socket.dev/blog/rv-is-a... @shortruby.com

🤖 Developers are rallying around AGENTS.md, a fast-emerging standard for giving instructions to AI coding agents. Already adopted in 20k+ repos and now supported by GitHub Copilot. Read more: socket.dev/blog/agents-...

This should be interesting! 🤠

Attackers are now experimenting with weaponizing AI developer tools to accelerate reconnaissance and data theft. By expressing goals in prompts, they skip writing custom code and tap into cross-platform expertise instantly, cutting development time for supply chain attacks.

🧹 New linter alert! @rspack.dev introduces Rslint, a TypeScript-first linter in Go powered by typescript-go. Fast, typed, ESLint-compatible, and part of the growing trend of toolchains building their own linters. socket.dev/blog/rspack-... #TypeScript #JavaScript

1Password, Bitwarden, LastPass, Enpass, iCloud Passwords, and LogMeOnce remain vulnerable to zero-day clickjacking vulnerabilities disclosed at DEF CON. Vendors downplayed or ignored the issue. Socket has filed a CVE to ensure these risks are formally tracked. socket.dev/blog/passwor...

📦 Astral, makers of Ruff & uv, have launched pyx: a Python-native package registry in beta, built to speed installs, boost security, and complement PyPI in the open source #Python packaging ecosystem. socket.dev/blog/astral-...

🚀 Day 4 of Launch Week: Introducing Rust support in Socket! Search any crate on socket.dev — no login required. Enterprise users get early access to experimental SBOM generation & full supply chain protection. 🦀 More Details → socket.dev/blog/introdu... #RustLang cc: @thisweekinrust.bsky.social

🚀 Day 3 of Socket Launch Week: We're launching Precomputed Reachability Analysis! Socket takes a radically different approach, using just your manifest files (package-lock.json, requirements.txt, pom.xml, etc.) to slash false positives by flagging up to 80% of CVEs as irrelevant.

🚀 Day 2 of Socket Launch Week: Introducing Socket MCP for Claude Desktop! Add one-click dependency security scanning to your Claude conversations. No CLI, no configuration files: just install and ask #Claude to check your dependencies. Try it now → socket.dev/blog/introdu...

Check out our case study to learn how JupiterOne partnered with Socket to: ⚡️ Integrate policy-driven security into CI/CD ⚡️ Cut false positives with reachability analysis ⚡️ Achieve audit-ready compliance automatically ⚡️ Scale security without additional overhead socket.dev/case-study/j...

🔥🔥🔥

Vibe coding with LLMs is making developers faster, but also creating new attack surfaces. Socket CEO @feross.bsky.social talks with Joel de la Garza of a16z about the future of AI-assisted software and supply chain security. 🎙️ Check out the full episode: socket.dev/blog/ai-a16z...