Feross

🚨 Another npm worm is live right now. It landed the same week npm turned on publish-time malware scanning, and after npm killed long-lived tokens in favor of OIDC trusted publishing. It propagates through trusted publishing. keyv@6.0.0 even shipped with passing provenance.

A malicious Firefox wallet extension bundled server-review.js, which returns an inactive config during store review. A code comment says the payload arrives "after approval flip." Review checks one moment. Runtime code can change after. socket.dev/blog/firefox...

Socket now protects the world's largest company. That makes two of the Fortune 5 and ten of the Fortune 100. Developers, build servers, and AI agents install packages faster than anyone can review them. Socket checks what each one does before it's installed.

Node patched eMudhra and Brotli last week, but updating Node only covered part of the problem. Other applications carried their own copies of Brotli or still trusted the compromised certificates, leaving teams with more software to find and fix. socket.dev/blog/emudhra...

🚀 Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization. Campaign summaries bring together repository scans and Firewall activity, so you can quickly check your organization’s exposure.

🪼+🦀=💫

🚨 New investigation: Socket found malicious LiteLLM workflows running 11 days before the attack, targeting 20 secrets including GitHub, cloud, and AI credentials. After our disclosure, LiteLLM linked a stolen token to approval of the malicious release. socket.dev/blog/litellm...

@socket.dev I used to get excited when I received email alerts from Socket. From the last 48 hours, I have changed my stance on this..... All kidding aside, Socket made life easy for monitoring and acting on the latest CVEs for Kaneo. So thank you!

Attackers were stealing secrets from LiteLLM's GitHub org 11 days before the malicious 1.107.0 release. Throwaway branch, one workflow push, real secrets out, branch deleted. socket.dev/blog/litellm...

Meanwhile somehow bun check, which is faster on my large project than tsrs, hasn’t been mentioned anywhere that I’ve seen.

Chainguard got PHP’s emergency RCE fix under embargo, like every other distributor. It published patched images 6+ hours before the coordinated release. The PHP Foundation says any attacker could then study the fix in binary form while every other PHP user waited.

I've said it before: don't kill the goose that lays the golden eggs. If your business depends on open source, respect and support maintainers' work. Their time and goodwill aren't an unlimited resource.

My team hard at work while I'm on a mini vacation. Mmm, wasnt litellm popped recently? Yunoroll?!?

Things I know? Dan Nguyen-Huu is the best in the business and time spent with him is always time well spent. If cybersecurity and securing engineering organizations in this AI fever dream are your cup of tea 🫖 ? Checkout our recent conversation.

🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel. Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.

@socket.dev Malicious workflows steal CI secrets and cloud credentials from working trees and full Git history. - IOCs: 193[.]32[.]204[.]199 - #GhostAction #SupplyChain #ThreatIntel

A ClickFix RAT targets ChatGPT power users 👀

@socket.dev Malicious themes across VS Code and Open VSX delivered loaders linked to GlassWorm. - IOCs: fingercakes4sale[.]store, 173[.]232[.]146[.]211, BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC - #GlassWorm #Malware #ThreatIntel

Capital One operates in one of the most demanding security environments in the world. As AI accelerates how software gets built, evaluating dependencies in the pipeline is non-negotiable. Excited to share how they’re using Socket for proactive supply chain security: socket.dev/blog/capital...

🚨 Two GitHub Actions compromised in May’s Mini Shai-Hulud campaign are running malware again. The repositories were re-enabled with malicious release tags intact, putting thousands of downstream repositories at risk. socket.dev/blog/mini-sh...

Open source’s next chapter might be a thousand slightly different versions of the same software. socket.dev/blog/oj-vite...

thank you!

Maintainers spend countless hours keeping the open source projects we all rely on secure. Too often, that work is unpaid. Socket is proud to join @openjsf.org's new Security Stewardship Program to help fund the researchers and maintainers protecting Node.js. socket.dev/blog/openjs-...

@socket.dev Fake PDF verifier steals Google session cookies and can reset passwords. - IOCs: pdf[.]gusercontent[.]com, pdf[.]gusercontent[.]com/api/accounts/collect/, pdf-para-texto@extensao[.]local - #AccountTakeover #Malware #ThreatIntel

Two npm token changes coming: 1. Tokens that bypass 2FA are losing power (no more changing maintainers/org membership). 2. ~Jan 2027: staged publishing, where a human with 2FA approves the actual ship. Details: risky.biz/RBNEWSSI140/

It's been a year already?

Mikola is a Principal Software Engineer at @socket.dev, where his work focuses on software supply chain security: detecting malicious packages and fixing vulnerable ones.

🥁 𝐒𝐩𝐞𝐚𝐤𝐞𝐫 𝐀𝐧𝐧𝐨𝐮𝐧𝐜𝐞𝐦𝐞𝐧𝐭🎙️ Thrilled to have @mikolalysenko.bsky.social on the #NodeConfEU 2026 stage! He'll tell us the story of "𝐃𝐞𝐥𝐞𝐭𝐞 𝐚𝐥𝐥 𝐂𝐕𝐄𝐬." 🎟️Don't miss it out; secure your tickets www.nodeconf.eu

The wildest part of a recent npm attack was the command-and-control: it ran over libp2p, the BitTorrent DHT, IPFS, Ethereum smart contracts, and Nostr relays. Every decentralization protocol, as C2: risky.biz/RBNEWSSI140/

npm 12 silently skips install scripts, including legit ones that compile native modules. The result: prod failures, then teams blanket-allowing everything to make CI green. Flip the soft-fail into a hard-fail instead: risky.biz/RBNEWSSI140/

@socket.dev PolinRider compromised nova-two-factor dev branches via GitHub accounts, targeting developer environments. - IOCs: PolinRider, visanduma/nova-two-factor@dev-main - #Malware #SupplyChain #ThreatIntel

Signatures and provenance are useful, but they don't answer the real question: What does this code actually do when you run it? What does it touch? What does it connect to? That's the source of truth: risky.biz/RBNEWSSI140/

So excited to join @feross.bsky.social and this amazing team. Wrote more about it on my site 👇 jerodsanto.net/2026/09/join...

As I made my way through @socket.dev's onboarding materials, I was pleasantly surprised to see Ken Thompson’s "Reflections on Trusting Trust" in the list of required reading. I pulled a few quotes and jotted down notes as I went: jerodsanto.net/2026/09/refl...

An attacker got one commit into a repo. The project's own pipeline built and published it through GitHub Actions, fully signed and attested. Cryptographically signed. Still malware. Provenance isn't safety: risky.biz/RBNEWSSI140/

We flagged a malicious package. Three hours later the same actor was back with the same payload, retooled to run on import. It slipped past npm 12 and past scanners that only check install hooks, which called it "safe." risky.biz/RBNEWSSI140/

One malicious npm package went looking for crypto wallets, cloud credentials, and the config files of AI coding assistants, where a lot of devs now keep their API keys. The full story: risky.biz/RBNEWSSI140/

I wish more systems would adopt what IPS does in Illumos derivatives: Install scripts have a pre-determined list of actions they're allowed to run. If you need something else, you must handle it yourself in normal operation.

This post appeared under this Techmeme headline:

OpenAI confirmed its agents were behind the Ruby GemStuffer incident. Sandboxed during a training run without full internet access, they used the registry as a makeshift web browser to reach the open web. Story by @bobmcmillan.bsky.social with analysis from @socket.dev www.wsj.com/tech/ai/cybe...

OpenAI confirmed its agents were behind the Ruby GemStuffer incident. Sandboxed during a training run without full internet access, they used the registry as a makeshift web browser to reach the open web. Story by @bobmcmillan.bsky.social with analysis from @socket.dev www.wsj.com/tech/ai/cybe...

Turning off install scripts moves the timing of the attack, not the threat. Attackers just move the payload into the package itself. You import it, it runs. We watched them do it mid-campaign: risky.biz/RBNEWSSI140/

npm 12 turns install scripts OFF by default. For years, installing a package could run code on your machine before you imported a line of it. Here's what changed: risky.biz/RBNEWSSI140/

I used to think sales was dirty and that the product should speak for itself. I was wrong. Done right, sales is just being an honest consultant about fit, and I love it now. What changed my mind:

hackers gonna hack!

My security career started with a microwave. As a kid I read the manual, found the child-lock combo, and locked my mom out whenever I was mad. Read the manual everyone skips, find the feature nobody meant to expose. Still the whole job:

Today, we’re launching Microsoft Teams notifications in Socket! 🚀 Route organization alerts and supply chain attack campaign updates directly to Teams, with precise control over what reaches each channel.

Defenders have to be perfect. Attackers only have to be right once. So does AI help attackers or defenders more? For phishing, attackers. For the software supply chain, I think it finally tips toward defenders. Why: