home.social

Socket

@[email protected]

Socket is a developer-first security platform that protects your code from both vulnerable and malicious dependencies. Next-gen SCA + SBOM + 0-day prevention. LOVED BY DEVELOPERS.

Posts
959
Followers
336
Following
53
Joined 2022-11-08 · View on fosstodon.org →
  1. Socket @SocketSecurity ·

    A Go typosquat impersonating the popular shopspring/decimal library stayed benign for years before shipping a DNS TXT backdoor that executes commands on import.

    The legitimate module has 38K+ known importers, making a single-letter typo a high-value target.

    socket.dev/blog/popular-go-dec

    #golang
  2. Socket @SocketSecurity ·

    🚨 BREAKING: Socket is investigating an active npm supply chain attack compromising hundreds of packages in the @​antv ecosystem.

    The malicious publish wave appears tied to Mini Shai-Hulud and packages connected to the npm maintainer account atool.

    socket.dev/blog/antv-packages-

  3. Socket @SocketSecurity ·

    🚨 Socket detected malicious activity in newly published versions of node-ipc, an npm package with 822K weekly downloads.

    Affected versions:
    [email protected]
    [email protected]
    [email protected]

    Socket’s AI scanner flagged the malware within ~3 minutes of publication.

    Early analysis shows obfuscated stealer/backdoor behavior, including host fingerprinting, local file enumeration, payload wrapping, and attempted exfiltration.

    socket.dev/blog/node-ipc-packa

  4. Socket @SocketSecurity ·

    cc: @campuscodi

  5. Socket @SocketSecurity ·

    🐘 @packagist is urging projects to update Composer after a GitHub token format change caused some GitHub Actions tokens to be exposed in CI logs.

    GitHub has rolled back the token change for now, but affected projects still need to update Composer.

    socket.dev/blog/packagist-urge

    #php
  6. Socket @SocketSecurity ·

    🚨 We detected malicious client packages published to npm and PyPI after a maintainer account compromise, enabling wallet theft and remote code execution.

    Full investigation → socket.dev/blog/malicious-dydx

    #dydx #crypto
  7. Socket @SocketSecurity ·

    🚨 New Research: Threat actors compromised four extensions, pushed malicious updates that load encrypted malware, evade Russian locales, and fetch C2 instructions via memos, leading to macOS credential and wallet theft.

    Full analysis: socket.dev/blog/glassworm-load

    #openvsx #solana
  8. Socket @SocketSecurity ·

    🚨 New from the Socket Threat Research Team: 5 coordinated Chrome extensions hijack sessions and block security controls in enterprise HR and ERP platforms like Workday and NetSuite.

    Full report → socket.dev/blog/5-malicious-ch

    #cybersecurity #enterprisesecurity
  9. Socket @SocketSecurity ·

    🚨 New research: A malicious Chrome Web Store extension is stealing newly created API keys and exfiltrating them to a Telegram bot, enabling full account takeover with trading and withdrawal rights.

    Details → socket.dev/blog/malicious-chro

    #mexc #crypto
  10. Socket @SocketSecurity ·

    🚨 New threat research: An impostor package typosquatted a popular .NET tracing library and its author, using homoglyph tricks to blend in, then exfiltrated wallet JSON and passwords to a Russian IP address.

    Full report →
    socket.dev/blog/malicious-nuge

    #nuget #stratis #dotnet
  11. Socket @SocketSecurity ·

    🚨 Socket’s Threat Research Team uncovered a malicious Chrome extension posing as an wallet. It steals seed phrases by encoding them into transactions and leaks them on-chain - no C2 needed.

    → socket.dev/blog/malicious-chro

    #ethereum #sui #crypto
  12. Socket @SocketSecurity ·

    🚨 Socket researchers discovered an npm package targeting traders. It hunts for wallet keys & credentials, then exfiltrates them via Telegram. A second package serves as a minimal wrapper to execute the payload.

    Full report → socket.dev/blog/malicious-npm-

    #crypto #bullx #javascript
  13. Socket @SocketSecurity ·

    📌 New from the Socket Research Team: A malicious npm package disguised as an integration triggers a reverse shell during payment success. Unlike many malicious packages that execute code during installation, this payload is delayed until runtime.

    socket.dev/blog/npm-package-ad

    #advcash #javascript
  14. Socket @SocketSecurity ·

    At , NIST revealed that the NVD is scrapping its consortium plan, walking back last year’s promise of reform, while pitching new tools that critics say won't meaningfully address the backlog or transparency problem.

    socket.dev/blog/vulncon-2025-n

    #vulncon #cve #cybersecurity #vulncon2025
  15. Socket @SocketSecurity ·

    📦 Our latest investigation of Black Basta's leaked chats shows how they were plotting to exploit open source package registries to deploy ransomware, plus our analysis of & wiperware packages already in the wild.

    socket.dev/blog/black-basta-de

    #ransomware #blackbasta #cybersecurity
  16. Socket @SocketSecurity ·

    🚀 Exciting news: Socket is now part of TC54! We're joining forces to help shape the future of SBOMs, CycloneDX, and PURL, making software supply chains more secure & transparent.

    socket.dev/blog/socket-joins-t

    #sbom #cyclonedx #purl #cybersecurity
  17. Socket @SocketSecurity ·

    🚨 The Socket Research team has uncovered a malicious npm package targeting developers using tools in their development environments: socket.dev/blog/malicious-npm-

    #ethereum #hardhat