Feross
@feross.bsky.social
🧙♂️ Mad scientist • ✨ Founder + CEO @Socket.dev (http://socket.dev) •🌲 Stanford lecturer (http://cs253.stanford.edu) • ❤️ Open source at WebTorrent + StandardJS
Must ... refrain... from logging in... during holiday... one more day. Good luck to anyone in/affected 🫂
Socket@socket.dev · yesterday🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all affected packages/versions.
🚀 Socket is now available in the AWS Security Hub Extended plan. Apply committed AWS spend, first month free. Also new: Socket Firewall bills on unique artifacts checked, not bandwidth or downloads. Pin 200 packages, install them a million times, pay for 200. socket.dev/blog/aws-sec...
AWS Security Hub Adds Socket for Supply Chain Security - Soc...
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
socket.dev
Trusted publishing is good, but it's still just an authn method and doesn't mean the package itself is safe to run. Good breakdown by @yossarian.net about that
You shouldn't trust Trusted Publishing
blog.yossarian.net
Feross@feross.bsky.social · yesterday🚨 Another npm worm is live right now. It landed the same week npm turned on publish-time malware scanning, and after npm killed long-lived tokens in favor of OIDC trusted publishing. It propagates through trusted publishing. keyv@6.0.0 even shipped with passing provenance.
🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all affected packages/versions.
Socket@socket.dev · yesterday🚨 Active npm supply chain attack: keyv@6.0.0 and 13 other packages have been compromised. keyv alone gets 154M weekly downloads. The worm steals cloud and CI credentials, then uses stolen npm tokens to publish trojanized versions of more packages.
Active exploits found by none other than the great and all powerful @feross.bsky.social & co socket.dev/blog/popular...
Popular npm Packages in the keyv and Cacheable Namespaces Co...
Popular npm packages keyv and cacheable compromised.
socket.dev
🚨 Another npm worm is live right now. It landed the same week npm turned on publish-time malware scanning, and after npm killed long-lived tokens in favor of OIDC trusted publishing. It propagates through trusted publishing. keyv@6.0.0 even shipped with passing provenance.
Composer and @packagist.com serve billions of package installs a year. For most of their history, they've been funded largely by a single company. This week @naderman.de and Jordi Boggiano announced a sponsorship program and @socket.dev signed on as a launch sponsor. Here's why.
After working with the @packagist.com team through recent supply chain attacks, it's clear how much they genuinely care about the health and security of PHP developers. They move fast & show up whenever the ecosystem needs them. If your company depends on Composer or Packagist, please support them.
Socket@socket.dev · 5d agoSocket is a launch sponsor of the new Composer and @packagist.com sponsorship program. Packagist is critical infrastructure for millions of #PHP developers, and we're proud to fund the work that keeps it secure and open. socket.dev/blog/socket-...
I like @feross.bsky.social, great guy and also socket is great for monitoring and auditing dependencies, but also: ahhhhhhhhh frontend JS ecosystem is stacks on stacks of compromises.
Wild case of what appears to be industrial espionage. The attackers found public code references to Alibaba’s private npm packages, then reused the names for unscoped package lures targeting developers with access to Alibaba’s internal tooling.
Socket@socket.dev · last wk.A covert npm campaign targeting @alibabagroup.bsky.social developers split its loader across benign-looking packages. Combined, they deployed a cross-platform RAT that poisons AI tool skills for persistence and spreads laterally through DingTalk. socket.dev/blog/npm-rat...
👉 if you're not able to upgrade for whatever reason, @socket.dev has released free Certified Patches that can be applied to older Nuxt releases
Socket Releases Free Certified Patches for Nuxt Security Vul...
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props...
socket.dev
Nuxt@nuxt.com · last wk.🔐 Nuxt 4.5.1 and 3.21.10 are out, fixing several security issues, plus a critical dev-only fix in @nuxt/devtools 3.3.1. Please upgrade as soon as you can: npx nuxt upgrade --dedupe 👉 Read more at nuxt.com/blog/v4-5-s....
We’ve reached out to service providers associated with the domain, and can happily report that corepack[dot]org has been taken down. As a reminder, the only official Node.js site is nodejs.org.
Node.js — Run JavaScript Everywhere
Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.
nodejs.org
Socket@socket.dev · 2w agoA fake corepack site at corepack[.]org is impersonating the Node.js Corepack tool and pushing malware to developers. The download button drops an infostealer that steals browser data and SSH keys, plus proxyware that turns your machine into a proxy node. socket.dev/blog/fake-co...
Shai-Hulud's downstream impact is still coming to light. The worm hit tens of thousands of GitHub repos, and the latest breach is Suno, whose leaked source code shows how it scraped YouTube, Deezer, and Genius to train its models. 🎩 First reported by @404media.co. socket.dev/blog/suno-br...
Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Mu...
A Shai-Hulud infection exposed Suno's source code, which shows the AI music startup stream-ripped tracks to train its models.
socket.dev
@socket.dev Four compromised @asyncapi npm packages delivered the Miasma botnet loader via IPFS downloads triggered on module import. - IOCs: 85. 137. 53. 71, ipfs. io, QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 - ...
AsyncAPI npm Supply Chain Attack
socket.dev
🚨 Attackers compromised four npm packages in the @asyncapi namespace to deliver the Miasma botnet loader. The malware runs when an infected module is imported, then pulls an encrypted payload from IPFS across macOS, Linux, and Windows. socket.dev/blog/asyncap...
Compromised npm Packages in the AsyncAPI Namespace Deliver M...
4 compromised asyncapi packages deliver miasma botnet loader on macOS, Linux and Windows.
socket.dev
🚨 5 malicious @asyncapi packages hit npm today via a poisoned commit and trusted publishing. Payload: Miasma, a multi-channel C2 framework pulled from IPFS. Socket flagged all five as malware. Pin versions, audit lockfiles. socket.dev/blog/asyncap...
Compromised npm Packages in the AsyncAPI Namespace Deliver M...
4 compromised asyncapi packages deliver miasma botnet loader on macOS, Linux and Windows.
socket.dev
@socket.dev Malicious jscrambler npm releases drop hidden native infostealer binaries targeting developer credentials and cloud secrets. - IOCs: jscrambler@8. 14. 0, a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60 - ...
jscrambler npm Package Compromised
socket.dev
🔺 Socket researchers found a malicious Go module posing as a DNS/subdomain scanner. Following that trail exposed 222 GitHub repositories across 190 accounts: fake software projects used to stage Windows RAT and infostealer malware. Full analysis → socket.dev/blog/malicio...
Malicious Go Module Exposes GitHub Malware Lure Network Span...
Socket tracks the activity as Operation “Muck and Load”: a threat actor uses commit-farming workflows, public dead drops, and protected archives to st...
socket.dev
🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs
npm v12 Ships With Install Scripts Off by Default, Begins De...
npm v12 is generally available, turning install scripts off by default and beginning the deprecation of 2FA-bypass publishing tokens.
socket.dev
This is a big deal. It kills like 99% of all npm malware we see today. Give or take. It won't go away. Of course. But it helps.
Socket@socket.dev · 4w ago🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs
Miasma Mini Shai-Hulud has expanded to the Go ecosystem, with a Verana Blockchain source archive containing malicious Claude and VS Code hooks. This is the same wave that hit LeoPlatform npm packages and targeted GitHub Actions workflows. socket.dev/blog/miasma-...
Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and Git...
Mini Shai-Hulud expands into the Go ecosystem after hitting LeoPlatform npm packages and targeting GitHub Actions workflows.
socket.dev
Surreal to see Socket sponsoring NodeConf EU. This is where I gave an impromptu talk on PeerCDN, my first startup, back in 2013, and where I met almost all my Node friends. Awesome to finally pay it forward.
NodeConf.eu@nodeconf.eu · last mo.🚀Thrilled to announce @socket.dev as #gold Sponsors of #NodeConfEU 2026! 🌟 Socket is a #cybersecurity platform that protects companies from software supply chain attacks. Find out more👉 socket.dev Thank you! Your partnership is helping us create something truly special in the #Node.js community!
Turn off automatic extension updates in your IDE. Make it the default.
Socket@socket.dev · 2mo agoNew Research: Trojanized Open VSX extensions are shipping GlassWASM, a new WebAssembly malware variant. It hides malware logic in TinyGo-compiled WASM and pulls C2 instructions from Solana transaction memos. socket.dev/blog/glasswa...
🧩 New Research: 152 Chrome "live wallpaper" extensions hid ad tracking behind false privacy disclosures and faked Google search traffic to support ad monetization. The network spanned 38 publisher accounts, 3 backend brands, and ~105K installs. socket.dev/blog/152-chr...
152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Fak...
A network of 152 Chrome live wallpaper extensions hid ad tracking and made extension-driven traffic look like Google search clicks.
socket.dev
Shocked, shocked I say
Socket@socket.dev · 2mo ago🧩 New Research: 152 Chrome "live wallpaper" extensions hid ad tracking behind false privacy disclosures and faked Google search traffic to support ad monetization. The network spanned 38 publisher accounts, 3 backend brands, and ~105K installs. socket.dev/blog/152-chr...
Andrew Becherer is joining Socket as our first CISO. He was Datadog's first security hire and led security there through its IPO. Socket protects 27,000+ orgs. Andrew will own how we protect ourselves and how we show up for the security teams we serve. socket.dev/blog/andrew-...
Andrew Becherer Joins Socket as Chief Information Security O...
Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.
socket.dev
OSV has withdrawn 157 malware reports after automated detections incorrectly flagged npm and PyPI packages as malicious, pushing bad records for trusted projects into OSV-consuming security tools and CI/CD systems. socket.dev/blog/osv-wit...
OSV Withdraws 157 Malware Reports After Automated False Posi...
OSV withdrew 157 OSV malware reports after automated false positives incorrectly flagged trusted npm and PyPI packages, sending bad records into tools...
socket.dev
Open source maintainers were already overloaded. AI-driven vulnerability discovery is about to send a lot more findings their way. @feross.bsky.social on TBPN 👇 socket.dev/blog/feross-...
Feross on TBPN: Socket's Series C and the State of Software ...
Feross Aboukhadijeh joins TBPN to discuss Socket's $60M Series C, 500%+ ARR growth, AI's impact on open source, and the rise in supply chain attacks.
socket.dev