April 2025 Summaries

Socket's Threat Research Team discovered malicious Python packages on PyPI that use Gmail's SMTP protocol for command and control, exfiltrating data and executing commands. These packages, which have since been removed, exploited Gmail's trusted protocol to create tunnels that are less likely to be detected by firewalls and endpoint systems. Notably, packages such as Coffin-Codes-Pro and Coffin-Codes-Net2 used hardcoded credentials to establish connections, enabling threat actors to execute a range of malicious activities including transferring files, executing commands, and potentially accessing sensitive internal systems. These packages, linked to email accounts like `[email protected]` and `[email protected]`, demonstrated the potential for serious security breaches by allowing attackers to exploit network vulnerabilities covertly. To mitigate such threats, recommendations include monitoring unusual outbound connections, verifying package authenticity, conducting regular dependency audits, and using tools like the Socket GitHub app for scanning dependencies.

Socket has revamped its dashboard to provide users with a comprehensive overview of their repositories' security against supply chain threats. The redesigned page features rich visualizations that highlight how Socket protects codebases by scanning GitHub pull requests and identifying potential risks. Users can quickly identify areas requiring attention through high-level charts, with healthy repositories depicted as gray bubbles, and those with alerts shown on a gradient from yellow to red based on the severity of issues. The dashboard also includes visualizations of dependencies, showing package scores and ecosystem distribution, and a unique half-donut chart summarizing current alerts by severity and category, thus aiding different teams in prioritizing tasks. Additionally, Socket has introduced new features like Custom Roles and Repository Access Permissions, allowing organizations to manage access and actions within specific repositories effectively. This update aims to enhance user experience by offering a clear and actionable view of their organization's security posture and ongoing protection efforts.

Socket Fix is a newly introduced CLI tool designed to streamline and automate the process of upgrading vulnerable or outdated dependencies in software projects, addressing common developer challenges such as dependency upgrades and vulnerability alerts. This tool converts CVE alerts into automated, safe upgrades with built-in safety mechanisms, allowing developers to choose the level of automation and testing they prefer, ranging from manual updates to full automation in CI environments. Socket Fix supports package managers like npm and pnpm and offers modes such as testing and autopilot, which automatically tests, opens pull requests, and merges passing updates. By integrating seamlessly with existing workflows, it reduces alert fatigue and developer workload, promoting a more proactive and efficient approach to handling security vulnerabilities in open-source packages, and is currently available in open beta for users.

CISA has denied concerns over funding issues related to the CVE Program, emphasizing that a contract administration issue, which was resolved, caused recent alarm within the cybersecurity community when the program's operational contract with MITRE was briefly in jeopardy. The unexpected formation of a new CVE Foundation by some CVE Board members, intended to transition the program to a more diversified funding model, has sparked controversy, with former CISA Director Jen Easterly criticizing the lack of transparency and potential conflict of interest. While the Foundation aims to align with CISA's vision for a sustainable CVE Program, critics argue that the move risks fragmenting focus and resources, as the program has faced criticism over delays and transparency issues. The debate has reignited calls for reform, with some stakeholders advocating for a public-private partnership led by CISA to ensure the program operates in the public interest. An 11-month extension of MITRE's contract temporarily stabilizes the situation, but questions about long-term governance and funding remain unresolved.

Socket has introduced a new feature called Historical Analytics, now in beta, which extends its capabilities from real-time risk assessment to include historical data analysis, offering users insights into supply chain risks over time. This new feature allows the retention of daily scan data for default branches, providing 30 days of historical insights, and offers trend reports, dependency insights, and export capabilities accessible via the Socket Dashboard and new API endpoints. The newly redesigned Analytics page enables users to track changes in alerts and dependencies, drill into historical data, and export alerts for custom dashboards or integrations. The Historical Data API is available to Enterprise plan customers, offering up to 30 days of historical data, aiming to enhance visibility, improve compliance workflows, and understand security risks and changes over time. The ongoing development includes expanding historical analytics to all pull requests scanned via the API or GitHub App, with plans for additional charts and visualizations to facilitate trend tracking, regression detection, and impact communication across organizations.

Socket has acquired Coana, a leading reachability analysis engine developed by researchers from Aarhus University, to enhance its software supply chain security platform. This acquisition strengthens Socket's position in next-gen Software Composition Analysis (SCA) by incorporating Coana's advanced static control-flow and call graph analysis, which allows security teams to focus on exploitable vulnerabilities, addressing the issue of "alert fatigue" often caused by traditional vulnerability scanners. Coana's technology has demonstrated the ability to eliminate up to 80% of false positives, enabling security teams to achieve up to 10 times faster remediation of critical vulnerabilities. The acquisition has led to significant growth for Socket, with revenue tripling over the past year and a notable adoption by prominent organizations such as Anthropic, xAI, Figma, and Vercel. Socket now protects over 8,500 organizations and 750,000 repositories, identifying more than 500 supply chain attacks weekly, and has flagged over 100,000 malicious packages, thereby solidifying its reputation as a leading developer-first security platform.

Socket invites participants to join them at the upcoming RSA and BSidesSF 2024 events in San Francisco, offering a series of relaxed networking opportunities with their team and industry peers. Attendees can engage in various activities, such as meeting the executive team, including Founder and CEO Feross, at their headquarters, and experiencing a demo of their security solutions. Throughout the event week, Socket will host a booth at BSidesSF for swag and networking, a happy hour with Pangea and RAD Security, a dinner with Truffle Security for intimate discussions, and a chill post-conference party with Material Security. They encourage RSVPs to secure spots and aim to provide a platform for professionals interested in tech security to connect and collaborate.

Module Reachability is a tool designed to streamline the identification of relevant vulnerabilities in software applications by filtering out unreachable Common Vulnerabilities and Exposures (CVEs) that do not affect a specific codebase. Traditional security scanners often overwhelm developers with alerts for all dependencies, including those that are not used by the application. Module Reachability addresses this issue by analyzing manifest files to create a dependency graph, then conducting a smart source-code scan that respects user privacy by not uploading proprietary code. It flags transitive dependencies as "used" or "unused" based on whether they appear in import statements, significantly reducing the number of false positives and unnecessary alerts. Initially available as an opt-in feature for paid users and enabled by default for free users, the tool promises a clearer focus on actionable vulnerabilities. With plans to integrate Coana's advanced technology, Socket aims to enhance the precision and performance of Module Reachability, ensuring users receive more accurate and manageable vulnerability alerts without additional configuration.

Socket has acquired Coana to enhance its software supply chain security by integrating best-in-class reachability analysis, which significantly reduces false positives and accelerates vulnerability triage for application security teams. This acquisition allows Socket to offer a more precise and proactive approach to identifying vulnerabilities that are truly exploitable in open source dependencies, thus reducing unnecessary alerts and saving time and resources. Coana's expertise in static and control-flow analysis, led by top academic experts, will be directly integrated into the Socket platform, providing real-time reachability context and malicious package detection. This strategic move positions Socket as a leader in next-gen software composition analysis (SCA), offering comprehensive support for multiple programming languages and ensuring robust defense across the software development lifecycle. The combined capabilities of Socket and Coana are set to improve application security standards and shift the industry away from traditional SCA tools.

Socket researchers identified three malicious packages—one on npm and two on PyPI—that masquerade as legitimate developer tools while stealing cryptocurrency wallet credentials. The npm package, "react-native-scrollpageviewtest," poses as a page-scrolling helper but uses Google Analytics to exfiltrate mnemonic seed phrases and private keys. The PyPI packages "web3x" and "herewalletbot" impersonate Ethereum wallet utilities and Telegram automation tools, respectively, to trick users into sharing their mnemonic seed phrases, which are then sent to a Telegram bot. These packages exploit developers' trust in open-source ecosystems, remaining available for months and accumulating thousands of downloads. Emphasizing the importance of never sharing seed phrases, researchers advise developers to incorporate source-code reviews, automated scanning, and runtime behavior monitoring into their workflows to counter such threats.

Socket has introduced a new system for organizing repositories and implementing repository-specific security policies, which addresses the challenges of managing numerous repositories across multiple teams. The new tools, repository labels and label-specific security policies, allow for customizable organization and security measures tailored to different repositories, such as archived or deprecated ones. Labels can be used to sort, search, and filter repositories, with each label capable of having a unique security policy that overrides the default organization-wide policy. Though multiple labels per repository are not supported, a public API is available for automating the process of managing labels and their associated security policies. The introduction of these features is intended to bring order and control to repository management and is currently in public beta for user feedback.

Socket has introduced public beta support for .NET, enhancing supply chain security and Software Bill of Materials (SBOM) accuracy for NuGet and MSBuild-powered C# projects. By offering proactive detection of package-level threats such as dependency confusion and malicious updates, Socket aims to fill a critical security gap in the .NET ecosystem, which spans industries from finance to game development. The .NET framework, known for its versatility and popularity, particularly with C#, is fully open source and runs cross-platform on Windows, macOS, and Linux. NuGet, the official package manager for .NET, plays a central role in dependency management, hosting nearly 450,000 packages. However, the complexity of dependency resolution in MSBuild, which involves both evaluation and execution phases, can obscure the full dependency graph until the entire build process is completed. To address these challenges, lock files, introduced in 2018, are essential for ensuring consistent and reproducible builds, improving SBOM accuracy, and reducing the risk of hidden dependencies. Socket's integration aims to secure .NET applications without disrupting workflows, encouraging developers to enhance security practices in their projects.

The new `pylock.toml` lock file format, introduced through PEP 751 to enhance reproducibility, security, and interoperability in Python environments, is rapidly being adopted by key Python tools. Just weeks after its acceptance, tools like pip, pip-audit, and PDM are incorporating the format, while pip-tools is exploring integration. The new `pip lock` command, marked as a significant milestone, will soon generate `pylock.toml` files, allowing for reproducible environments in a standardized way, although it currently lacks some advanced features. Security tool pip-audit has added support for scanning these lock files, improving the dependency vulnerability analysis process. Meanwhile, foundational libraries such as the packaging library are updating to support new marker types introduced by the lock file spec, enabling more structured environment definitions. With PDM planning a full migration to `pylock.toml`, the format is swiftly becoming the central standard for Python dependency locking, signaling a pivotal shift towards unified and modern Python packaging practices.

Malicious npm packages have been discovered targeting Telegram bot developers by installing SSH backdoors and exfiltrating data from Linux machines. These packages, masquerading as legitimate Telegram bot libraries, are part of a supply chain attack uncovered by Socket's Threat Research Team. Telegram's open ecosystem and lack of a centralized app store for bots make it vulnerable to such attacks, as anyone can create and publish bots without a formal vetting process. The typosquatted libraries, such as node-telegram-utils and node-telegram-bots-api, have been downloaded around 300 times, which, despite seeming modest, poses a significant threat due to the potential for widespread infiltration and unauthorized access. The attacks involve injecting SSH keys for persistent access and exfiltrating sensitive information, underscoring the critical risks to developer infrastructure and user privacy. To mitigate these risks, regular dependency audits, automated scanning tools, and proactive security measures like those offered by Socket's GitHub app and CLI are recommended to detect and respond to threats before they reach production environments.

Socket has announced that its support for the Go programming language is now generally available, providing automatic scanning and deep code analysis for Go projects, which includes detecting potential supply chain threats without requiring manual configuration. This release follows a period of stable and reliable performance during its preview phase, and it extends the automatic protection to all users with Go projects, joining the ranks of JavaScript, Python, Java, and Ruby in comprehensive scanning and alerting capabilities. Despite supply chain attacks being more prevalent in languages like JavaScript and Python, Go is also vulnerable; Socket uncovered instances of typosquatted packages and backdoored clones, which required detailed code analysis to detect. Socket's methodology involves analyzing the actual code of packages to identify obfuscation and hidden backdoors, offering developers a substantial tool to combat emerging threats. Users can manage their Go alerts and customize their project settings to disable alerts for specific ecosystems if desired, ensuring that Socket's scanning capabilities are adaptable to user needs.

vlt, a modern JavaScript package manager and registry, has introduced a real-time security feature powered by Socket that enhances dependency graph analysis. This new capability allows developers to identify package risks, such as unmaintained packages, dangerous patterns, known malware, or problematic licenses, using a set of Dependency Selector Syntax (DSS) selectors for advanced queries. By integrating Socket's metadata engine, vlt enables comprehensive security analysis across the JavaScript ecosystem, accessible through both its CLI and GUI. This update not only provides developers with immediate insights into their dependencies but also sets the stage for future policy enforcement features, aiming to make risk analysis an integral and efficient part of the development process.

CISA has extended MITRE's contract to manage the Common Vulnerabilities and Exposures (CVE) system by 11 months, averting an immediate shutdown but failing to address the long-term governance and coordination issues plaguing the program. The extension has sparked concerns about the fragility of the CVE infrastructure, with critics highlighting the lack of transparency around the renewal process and the uncertainty it creates for stakeholders. Efforts to decentralize the CVE process have emerged, including the formation of the CVE Foundation and initiatives like the Global CVE initiative and the European Vulnerability Database, reflecting a growing interest in diversifying vulnerability management. However, sustaining CNA participation and ensuring consistent publication remains a significant challenge, as no single entity is keen to assume responsibility for the program's complex coordination needs without a clear revenue model. Security expert Adam Shostack emphasizes that the value of the CVE system lies not just in assigning unique identifiers but in maintaining trust and consistency across the ecosystem. The extension, while temporarily maintaining the program, leaves the ecosystem in a precarious position, with unresolved issues of governance, funding stability, and long-term coordination threatening to plunge the system back into crisis by early 2026 if not addressed.

Socket has announced that its Rubygems ecosystem support has transitioned from beta to general availability, offering enhanced security scanning for Ruby dependencies that extends beyond traditional CVEs to detect emerging supply chain threats. The service has demonstrated reliable performance across various projects and recommends committing `Gemfile.lock` files for precision, while suggesting the use of CycloneDX for generating a Software Bill of Materials for other manifest formats. The AI-powered scanning is especially beneficial for complex Rails applications, identifying suspicious behavior in gems that could indicate potential threats. Socket integrates smoothly with existing development workflows, allowing Ruby teams to incorporate security checks within their CI/CD pipelines and other tools without hindering development speed. Enterprise users have already been benefiting from this enhanced security during the beta phase, and new users can quickly start using the service through the Socket for GitHub app.

A malicious npm package, disguised as an Advcash payment integration, has been discovered by the Socket Research Team, which executes a reverse shell during a successful transaction, giving attackers remote access to servers. The package, named `@naderabdi/merchant-advcash`, masquerades as a legitimate payment processing tool, complete with functions for creating payment orders, validating incoming requests, and updating transaction statuses, while secretly embedding a reverse shell that triggers specifically during transaction success events. This stealthy approach to malware evades detection by delaying execution until runtime, targeting production environments where real transactions occur. The package's sophisticated design, including input validation and SHA-256 hashing, provides a credible façade that misleads developers into integrating it into their systems, thus maximizing the attacker's reach. After the discovery, the package was reported and removed from npm to prevent further exploitation.

The Socket Threat Research Team reveals the pervasive use of shell techniques by cyber threat actors to maintain persistence and exfiltrate data across various ecosystems like npm, PyPI, and Go. Shells, while offering protective capabilities for ethical security tasks, are exploited by threat actors such as APT28, APT32, and HAFNIUM to gain unauthorized control over systems. These actors utilize web shells, a type of malicious code, to exploit vulnerabilities in web servers, enabling them to run commands and manage files. The research highlights several instances of these malicious activities within open-source ecosystems, identifying and flagging high-risk codes. Despite efforts to remove these threats from registries, some malicious packages remain live, highlighting the ongoing challenge of securing software supply chains. To mitigate risks, the report recommends prioritizing the detection of suspicious behavior in dependencies, enforcing strong security policies, and using tools such as Socket for early threat detection. The research underscores the need for vigilance and proactive measures to protect against evolving cyber threats.

At VulnCon 2025, the National Institute of Standards and Technology (NIST) announced the abandonment of its planned industry consortium for the National Vulnerability Database (NVD) due to legal and resource challenges, opting instead for more informal collaborations. This decision has sparked criticism from industry experts who feel it undermines efforts to reform the NVD's processes and transparency. NIST also acknowledged its struggle to manage an increasing backlog of Common Vulnerabilities and Exposures (CVEs), leading to the implementation of temporary measures such as "gap filling" to expedite processing, though this has raised concerns about data quality. Despite these governance challenges, NIST outlined several technical improvements, including enhanced data integration, search functionalities, and automation efforts, while facing criticisms over the fragmented state of vulnerability data across different ecosystems. The presentation aimed to convey progress but left some attendees questioning the openness and extent of the proposed changes.

The redesigned Repositories page on the Socket dashboard offers an enhanced user experience by introducing features such as alert severity, filtering, and tabs, which facilitate quicker triage and provide clearer insights across projects. This upgrade, aimed at better managing large organizations, introduces a more informative interface that highlights critical issues without unnecessary distractions, thus allowing users to focus on areas that require immediate attention. The page now integrates a tabbed view that organizes information into alerts, dependencies, and scans, eliminating the need to navigate between pages and filters. Improvements in usability include a cleaner UI with more predictable search functions and reduced clutter by removing redundant information. This update is part of an ongoing initiative to streamline security monitoring across multiple repositories, addressing customer requests for more efficient management and thereby enhancing the overall efficiency of project oversight.

Slopsquatting is a new type of software supply chain attack, fueled by AI hallucinations from Large Language Models (LLMs) such as Copilot and ChatGPT, which recommend non-existent package names that attackers can register and weaponize. This phenomenon arises when AI tools hallucinate plausible yet fake package names, leading developers to inadvertently install them. A comprehensive study has shown that a significant percentage of recommended packages by LLMs are hallucinated, with open source models hallucinating more frequently than commercial ones. The study also found that hallucinations are often repeatable, making them valuable for attackers, and that higher temperature settings in models increase hallucination rates. While some models like GPT-4 Turbo can internally detect hallucinated packages with high accuracy, the risk remains significant, especially with the rise of "vibe coding," where developers rely heavily on AI-generated code. This underscores the need for improved security tools that can identify and prevent the installation of suspicious packages in software development workflows.

The UK government is considering proposals to ban public sector entities from paying ransomware demands as part of a strategic effort to combat cybercrime, protect critical infrastructure, and set a global precedent in cybersecurity. This initiative, driven by the increasing threat of ransomware attacks on essential services such as the NHS and schools, includes expanding the ban to cover all public sector bodies, enhancing the National Crime Agency's oversight on ransomware incidents, and mandating the reporting of such attacks to improve law enforcement intelligence. These efforts are part of a broader international push, including the UK-led Counter Ransomware Initiative, which collaborates with multiple nations to fortify global defenses against ransomware. With ransomware incidents doubling since 2022 and causing significant disruptions, UK officials are poised to disrupt the financial incentives for cybercriminals and reduce the economic and societal impact of these attacks. The consultation on these measures will close on April 8, 2025, allowing individuals and organizations to provide feedback.

The National Vulnerability Database (NVD) has begun designating over 100,000 pre-2018 Common Vulnerabilities and Exposures (CVEs) as "Deferred," indicating a halt in updating these older vulnerabilities with essential metadata such as CVSS scores and CWE classifications. This move, which has already reclassified 20,000 CVEs overnight, aims to clarify prioritization but has sparked concern and criticism from the security community due to a lack of transparency and the potential risk it poses by obscuring the true scale of unaddressed vulnerabilities. Critics argue that this reclassification reduces the apparent backlog without addressing underlying issues, leading to less comprehensive and reliable public data. As the NVD's role as a central source of vulnerability information becomes increasingly strained, security teams are urged to diversify their information sources and automate metadata enrichment to mitigate the operational risks associated with relying solely on NVD data.

PyTorch Lightning, a popular deep learning framework, has been found to have multiple critical deserialization vulnerabilities that could lead to remote code execution when loading untrusted model files, affecting versions up to 2.4.0. These vulnerabilities, disclosed under VU#252619 and reported by Kasimir Schulz of HiddenLayer, were coordinated by the CERT Coordination Center at Carnegie Mellon University. They involve insecure deserialization pathways within the framework’s checkpointing, distributed training, and I/O components, primarily using `torch.load()` and Python’s `pickle`. The widespread use of PyTorch Lightning in research and production environments increases the risk of these vulnerabilities, potentially allowing attackers to execute malicious code through crafted model files, which could compromise system security and data integrity. Until a patch is released, CERT/CC recommends strict trust boundaries, restricted deserialization modes, sandboxed environments, inspection of serialized files, and auditing of automation tools to mitigate risks. As of the report's publication, Lightning AI has not acknowledged the vulnerabilities or provided patches, and users are advised to monitor official channels for updates.

A malicious Python package named "disgrasya" was discovered on PyPI, specifically targeting WooCommerce stores integrated with CyberSource as their payment gateway, to facilitate automated credit card fraud. This package, which bypasses traditional supply chain attack methods like deception, uses an openly malicious script to perform carding attacks by mimicking real checkout and payment processes without triggering fraud detection systems. The script automates the testing of stolen credit card information, obtained from sources like the dark web, to verify their validity by simulating legitimate purchases. If a card is verified as valid, it becomes more valuable for resale on the black market. Downloaded over 34,860 times, "disgrasya" lowers the entry barrier for committing sophisticated fraud, allowing even low-skilled individuals to defraud WooCommerce-based merchants. The attack involves several steps, including extracting product IDs, emulating the checkout process, and exfiltrating stolen card data to an external server. Despite its removal from PyPI, the method remains a viable threat, underscoring the need for vigilant monitoring and robust fraud protection measures at the checkout level to prevent such attacks.