🚀 Socket is now available in the AWS Security Hub Extended plan. Apply committed AWS spend, first month free. Also new: Socket Firewall bills on unique artifacts checked, not bandwidth or downloads. Pin 200 packages, install them a million times, pay for 200. socket.dev/blog/aws-sec...

AWS Security Hub Adds Socket for Supply Chain Security - Soc...

Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

socket.dev

🚨 An npm worm is spreading live, while half of the security industry is at #BlackHat in Vegas. talk about timing! @socket.dev is now tracking 2,234 malicious package artifacts across 444 unique packages in the keyv/cacheable compromise. Average detection time: 5 min 18 sec after publication

Popular npm Packages in the keyv and Cacheable Namespaces Co...

Popular npm packages keyv and cacheable compromised.

socket.dev

Excited by the approach Packagist has taken here, and so incredibly excited for Socket to be a launch sponsor. socket.dev/blog/socket-...

Socket Is Sponsoring Composer and Packagist - Socket

Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secur...

socket.dev

The White House launched a new initiative to coordinate AI-discovered vulnerabilities across government, critical infrastructure, and open source. No operating plan is public yet, even as federal vulnerability programs face massive backlogs and failures. socket.dev/blog/white-h...

White House Launches Gold Eagle Initiative to Manage Surge i...

The White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical s...

socket.dev

New research: We’re seeing more packages designed to trip up AI malware scanners. This new package uses prompt-injection-style comments, safety-triggering content, context flooding, and obfuscated JS to probe where scanners refuse, truncate, or miss the code that matters. socket.dev/blog/npm-pac...

npm Package Uses Prompt Injection and Token Flooding to Disr...

A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.

socket.dev

🔥 Socket Firewall is now built into Replit's AI-powered development experience. It’s already blocking 8K malicious packages/day across builders on the platform, giving Replit users stronger protection by default at the moment dependencies are introduced. socket.dev/blog/socket-...

Socket Partners with Replit to Block Malicious Packages in A...

Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.

socket.dev

npm accidentally marked a bunch of one-character packages as security holders, including c, i, n, x, several numbers, and even the - package. The registry confirmed it was a tooling bug and said a rollback is underway. socket.dev/blog/npm-too...

npm Tooling Bug Incorrectly Marks One-Character Packages as ...

npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

socket.dev

npm nuked every granular access token that bypasses 2FA after another Mini Shai-Hulud wave compromised hundreds of packages. Good news: staged publishing is now in public preview. socket.dev/blog/npm-inv... #NodeJS #JavaScript

npm Invalidates Granular Access Tokens as Mini Shai-Hulud Sw...

npm invalidated all granular access tokens that bypass 2FA after a fresh Mini Shai-Hulud wave compromised 323 npm packages. Staged publishing also ent...

socket.dev

Socket raised a C round! (Maybe we should be SoCket now! ok eeew no) All I can see on my part is that I've been having an awesome time working on AI and with AI, detection, and what not. Lucky to be part in the right place at the right time :D bsky.app/profile/fero...

Feross@feross.bsky.social · 3mo ago

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

Today's "Mini Shai-Hulud" supply chain attack is a wild evolution! 1. Cascading, cross-ecosystem propagation (PyPi ➡️ npmjs ➡️ Packagist) 2. Using a JS runtime (Bun) to infect Python and PHP 3. Impersonates Claude in git commits to hide in plain sight 🧵

We’re tracking 73 Open VSX sleeper extensions tied to the GlassWorm campaign, with at least 6 already activated to deliver malware. These cloned extensions initially appear benign, then later become malware delivery vehicles through normal updates. socket.dev/blog/73-open...

73 Open VSX Sleeper Extensions Linked to GlassWorm Show New ...

Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.

socket.dev

🚨 Breaking: Namastex Labs, the team behind Automagik[.]dev, hit with a supply chain attack affecting its npm packages. The malicious versions replicate TeamPCP-style Canister Worm tradecraft, including secret theft, exfiltration, and self-propagation. socket.dev/blog/namaste...

Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm...

Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

socket.dev

Goosonomics (noun) 🪿 A hypocritical corporate strategy of extracting immense financial value from unpaid, open-source labor, only to later declare OSS "dead" or untrustworthy to justify forking, rebuilding, and rebundling that exact same software as a premium, "safe" product.

Socket@socket.dev · 4mo ago

🪿 There are some wild takes out there right now about open source being “dead” after recent supply chain attacks and rapid advances in AI-driven security. Let’s talk goosenomics for a minute. → socket.dev/blog/dont-ki...

"Docker Hardened Images for Node.js, Python, and Rust also include Socket Firewall, which blocks malicious dependencies at install time." Another tool for securing your build pipeline - DHI are free and open source: socket.dev/blog/socket-...

Docker@docker.com · 4mo ago

The biggest failure in recent supply chain attacks isn't a single vuln, it's implicit trust. Stolen creds poison packages, poisoned packages steal creds, and the loop keeps accelerating. Docker’s CISO breaks down what’s actually happening & what teams can do to reduce risk: https://bit.ly/3NMjF8K

North Korea is targeting npm maintainers. Not for crypto. For write access to packages downloaded trillions of times a year. Lodash. Fastify. axios. mocha. Node.js core. Even @feross.bsky.social and several @socket.dev engineers! socket.dev/blog/attacke...

Attackers Are Hunting High-Impact Node.js Maintainers in a C...

Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

socket.dev

We’re seeing cases where teams can’t explain how they were compromised by the Axios incident because it doesn’t show up in their project's lockfile. The blast radius here is much larger than it looks. Deep dive into the messy reality of modern dependency resolution → socket.dev/blog/hidden-...

The Hidden Blast Radius of the Axios Compromise - Socket

The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

socket.dev

The axios compromise blast radius is much much much bigger than people seem to suspect. The secret: transitive dependencies with open ranges making it extremely obscure and difficult to detect whether you were affected, after the fact.

Socket@socket.dev · 4mo ago

🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript

⚠️ If you're running local mcp servers, you need to do the following: 1. Individually "install" packages you want to use, within a specified directory: (e.g. $HOME/mcp) creating a lockfile 2. Add: "--include-workspace-root --workspace $HOME/mcp --no --offline" to EVERY npx call

Socket@socket.dev · 4mo ago

🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript

📢 ZERO SIGN UP, FREE FOREVER, MALWARE PROTECTION. npm i -g sfw sfw npm install sfw pnpm install sfw yarn install sfw cargo fetch sfw uv pip install socket.dev/blog/introdu...

Introducing Socket Firewall: Free, Proactive Protection for ...

Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain atta...

socket.dev

sigh.

🚨 NOT AN EARLY APRIL FOOLS! 🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today! If you use axios, pin your version and audit your lockfile. Socket's Analysis: socket.dev/blog/axios-n...

Supply Chain Attack on Axios Pulls Malicious Dependency from...

A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHu...

socket.dev

This is an important situation for every security tool and open source project to monitor right now. cc: @campuscodi.risky.biz @thehackernews.bsky.social @bleepingcomputer.com @techcrunch.com @zackwhittaker.com

Ahmad Nassri@ahmadnassri.com · 4mo ago

These tools are secret + infrastructure + code security scanners by design and used in critical enterprise workflows. If compromised, they risk exposing production environments' secrets with a direct view into where the weak points are. socket.dev/blog/teampcp...

These tools are secret + infrastructure + code security scanners by design and used in critical enterprise workflows. If compromised, they risk exposing production environments' secrets with a direct view into where the weak points are. socket.dev/blog/teampcp...

TeamPCP Is Systematically Targeting Security Tools Across th...

TeamPCP is targeting security tools across the OSS ecosystem, turning scanners and CI pipelines into infostealers to access enterprise secrets.

socket.dev

GitHub Actions considered malicious, everybody move back to Jenkin! 🙈 "GitHub’s architecture makes fork commits reachable by SHA from the parent repo" 🚨 amazing breakdown by Rose Security 👏 rosesecurity.dev/2026/03/20/t... #trivy #github #actions #sca #supplychain #security

🚨 AquaSecurity's private source code seems to be fully compromised and in the open, released by the attackers today to github.com/aquasec-com The leak includes private keys credential scripts in the exposed repos. All repos have description: "TeamPCP Owns Aqua Security."

In less than 6 months, companies shipping software in Europe face the first Cyber Resilience Act deadline. ENISA's latest advisory on secure package manager use spells out expectations for SBOMs, dependency monitoring, and vulnerability reporting. socket.dev/blog/enisa-t...

ENISA Publishes Technical Advisory on Secure Use of Package ...

ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act be...

socket.dev

⚠️ UPDATE: we're now tracking 213+ affected package artifacts across this campaign! socket.dev/supply-chain...

GlassWorm v2 - Socket

Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript, Python, and Go dependencies.

socket.dev

Ahmad Nassri@ahmadnassri.com · 5mo ago

🚨 VSCode & OpenVSX users, take note: The "GlassWorm" campaign has evolved to weaponize the very structure of your IDE Extensions. The @socket.dev Research Team just uncovered over 73 new malicious OpenVSX extensions. Read the full technical breakdown + IOCs on our blog socket.dev/blog/open-vs...

🚨 VSCode & OpenVSX users, take note: The "GlassWorm" campaign has evolved to weaponize the very structure of your IDE Extensions. The @socket.dev Research Team just uncovered over 73 new malicious OpenVSX extensions. Read the full technical breakdown + IOCs on our blog socket.dev/blog/open-vs...

72 Malicious Open VSX Extensions Linked to GlassWorm Campaig...

Since January 31, 2026, we identified at least 72 additional malicious Open VSX extensions, including transitive GlassWorm loader extensions targeting...

socket.dev

Join @socket.dev + @cloudflare.social in a livestream NOW discussing #SANDWORM_MODE the Shai-Hulud-Style npm Worm Hijacking CI Workflows and Poisoning AI Toolchains www.youtube.com/watch?v=OQ6w...

🚨 Active Shai-Hulud–Like npm Supply Chain Attack: SANDWORM_MODE

YouTube video by Socket Security

youtube.com