June 2026 Summaries

Over the past six months, the open source ecosystem has faced an unprecedented wave of software supply chain attacks, with attackers compromising widely used packages and exploiting trusted developer workflows. This surge in attacks coincides with the rise of AI coding agents, which transform software development by rapidly introducing dependencies and making trust decisions without thorough context. This combination amplifies the challenges for teams relying on open source software, as traditional security tools often fail to detect malicious packages. In a discussion with Patrick Gray, Socket founder and CEO Feross Aboukhadijeh highlights these issues and introduces Socket Firewall as a solution that blocks malicious packages and code extensions before they reach developers. Socket Firewall can be integrated as a package manager wrapper, in CI, or as a network proxy for internal package registries. While AI complicates the supply chain problem by accelerating risk, it also offers defenders new capabilities to review open source code at an unprecedented scale.

Malicious Chrome and Firefox extensions posing as free VPNs were found to be exfiltrating clipboard data to threat actors' infrastructure through staged updates, as analyzed by Socket's Threat Research Team. These extensions, branded as VPN Go: Free VPN, initially appeared as legitimate proxy tools but secretly introduced clipboard-stealing logic in later versions, targeting sensitive information like passwords and cryptocurrency addresses by exploiting users' normal copy-paste behavior. The malicious code split copied text into chunks and transmitted it to hardcoded IP addresses, with Chrome versions 1.1 and 1.2 using an earlier IP address and version 1.3 and Firefox versions 1.3.3 and 1.3.4 switching to a new IP. Although these extensions marketed themselves with privacy-focused claims, their actual behavior contradicted these promises, prompting reports to Google and Mozilla for review and removal. The extensions used shared infrastructure and code, highlighting the importance of scrutinizing browser extensions that request broad permissions, especially when their functionality does not justify such access.

A recent cyberattack demonstrated the growing threat of supply chain compromises, with malicious npm releases affecting legitimate @immobiliarelabs Backstage packages used within GitLab and LDAP authentication plugins. This incident is part of the ongoing Miasma Mini Shai-Hulud campaign, highlighting its persistent pattern of exploiting developer infrastructure by publishing harmful package versions and deploying JavaScript malware to steal developer and CI/CD secrets. The compromised packages, crucial for internal developer portals with source-control and authentication integrations, pose significant risks as they may facilitate unauthorized access to sensitive environments. The attack was executed through a strategic GitHub Actions deployment, potentially involving a compromised codfish/semantic-release-action that allowed threat actors to inject malicious code and trigger unauthorized releases. As a result, affected environments must undergo thorough reviews, and security measures such as rotating credentials and auditing workflows are imperative to mitigate the threat and prevent further propagation. This incident underscores the critical need for stringent CI/CD security practices and the importance of monitoring for suspicious activity within development environments.

Rolldown and Vite removed a Rust-based React Compiler integration due to concerns about increased binary size, which would affect all users by default. The decision followed debates among developers over whether the 17% binary size increase was justified, given Vite's framework-agnostic nature and the additional weight it would impose on users not utilizing React. Some argued for the necessity of the integration for its performance improvements, while others suggested it should be an optional plugin to avoid unnecessary bloat. The discussions highlighted a broader trend toward native tooling in frontend frameworks, with other frameworks like Angular also exploring Rust compiler work. Meanwhile, suggestions for mitigating size increases, such as compressing native addons, are being explored to balance performance gains with installation efficiency. Despite the initial removal, experiments continue to refine the implementation, aiming to offer performance benefits without significantly increasing the binary size for all users.

A recent wave of supply chain attacks has targeted npm packages, GitHub Actions, and a Go module, affecting ecosystems like LeoPlatform and RStreams with malware from the Mini Shai-Hulud, Miasma, and Hades family. The attack involves npm registry poisoning, malicious GitHub workflows, and AI coding assistant persistence, aiming to steal credentials and propagate through developer environments. The attack features sophisticated techniques such as using binding.gyp for install-time execution, Bun-staged JavaScript malware, and secret theft via GitHub Actions. Notably, the attack also extends to the Verana Blockchain project, indicating a broader campaign beyond npm installations. The malware employs a complex multi-layered payload execution pattern using ROT and AES-GCM for obfuscation and targets various developer credentials and CI/CD secrets, exploiting IDE and AI-agent hooks for persistence. The campaign is marked by GitHub dead-drop infrastructure and has ties to previous compromises, emphasizing the need for rigorous security audits and secret rotations for affected environments.

The abrupt suspension of global access to Anthropic's AI models, Claude Fable 5 and Mythos 5, by the U.S. government highlights the increasing national security concerns and regulatory complexities surrounding advanced AI technologies. Triggered by perceived vulnerabilities and potential misuse, the federal ban has disrupted the AI landscape, particularly affecting organizations reliant on these models for cybersecurity and infrastructure defense. This intervention, driven by findings from Amazon and subsequent government actions, underscores the evolving view of AI systems as strategic assets, subject to rapid regulatory intervention. The situation has spurred significant industry backlash, with a coalition of security experts arguing that such restrictions harm national security by limiting domestic access to critical AI tools, while foreign competitors remain unencumbered. The shutdown also prompts a reevaluation of AI dependency risks, pushing organizations toward local, open-weight alternatives to mitigate reliance on single-provider cloud solutions. As policymakers and industry stakeholders navigate this new reality, there is a growing call for a standardized framework to assess AI security risks and safeguard bypasses to prevent future abrupt disruptions.

The integration of AI assistants in handling tasks like tidying and charting spreadsheets has introduced significant challenges in software supply chain security, as these agents can autonomously pull and execute open-source packages in sandbox environments without oversight. This shift has dramatically altered the threat landscape, reducing the skill barrier for executing malicious code and expanding the attack surface, as more code runs fleetingly in environments not monitored by traditional tools. Conventional vulnerability management methods, which assume rare attacks with longer response times, struggle to cope with the rapid pace of modern threats, where exploits can emerge within minutes of a patch release. Solutions like Socket's threat intelligence feed and ingest control offer a promising approach by providing real-time updates on compromised packages and enabling immediate blocking of risky dependencies, although the challenge remains in identifying where these control points should be placed, especially in decentralized environments. As organizations like Socket demonstrate rapid growth and effectiveness in blocking supply chain attacks, there is a growing expectation that threat feeds integrated into ingest controls will become a standard security measure, much like endpoint detection today.

GitHub has released actions/checkout v7 with enhanced security measures to mitigate risks associated with privileged workflows executing code from untrusted pull requests. This update aims to address a long-standing vulnerability where workflows, particularly those using pull_request_target, could inadvertently run malicious code with elevated privileges, leading to potential unauthorized access to repository secrets. The new default behavior blocks unsafe fork checkouts unless explicitly allowed, marking a significant step in tightening GitHub Actions' default security posture. While this change addresses a critical attack vector, it does not cover all potential vulnerabilities, such as those introduced through custom scripts or other actions, and requires maintainers to remain vigilant when configuring workflows that involve package installations or run privileged operations. This update follows prior efforts by GitHub to enhance security and highlights the need for continuous review and cautious handling of workflows that combine privileged triggers with untrusted code execution.

Socket has introduced Custom Roles and Repository Access Permissions to offer more precise access control for organizations, addressing the complexity of modern engineering teams that don't fit neatly into a single security framework or set of repositories. These features allow admins to define specific roles and permissions tailored to an organization's internal workflows, enabling them to grant access based on necessity rather than broad, built-in roles. Custom Roles allow for the creation of roles like Security Analyst or Developer Contributor with specific capabilities, while Repository Access Permissions can limit a member's actions to particular repositories. This two-layer access model supports least-privilege access, reducing unnecessary visibility and enhancing security, particularly as organizations scale, bring in contractors, or manage sensitive repositories. Admins can manage and audit these settings through the Socket dashboard, ensuring that access is aligned with team responsibilities and improving onboarding and offboarding processes. These new features complement existing built-in roles, allowing organizations to adopt a more granular approach to access management without disrupting current configurations.

AppSec and security engineering teams are increasingly pressured to manage supply chain issues more efficiently, requiring comprehensive context and reducing manual efforts, and Socket MCP addresses this challenge by integrating these workflows into MCP-aware AI assistants. With authenticated access to Socket APIs, teams can seamlessly investigate organizational alerts, inspect package artifacts, review threat feeds, and ask follow-up questions about exposure and risk without switching between multiple tools. Socket MCP extends its capabilities beyond real-time package scoring to include package inspection, alert triage, and threat feed reviews, transforming it into a comprehensive supply chain security interface for AI assistants. This allows developers and security teams to evaluate dependencies, inspect packages without local installation, and prioritize alerts based on potential risks. The integration supports various package ecosystems, enabling teams to inspect published files, understand suspicious behavior, and ensure safe package use, while also providing developers a streamlined process to vet dependencies before adding them to their projects.

Socket has uncovered a significant npm supply chain attack involving over 140 compromised packages published within the @mastra namespace. These packages, published by a single npm account, contained an injected typosquatted dependency, easy-day-js, which harbored malware. This malware executed automatically during npm installation, potentially compromising systems before developers used the packages. The attack involved a two-stage payload; the first stage deactivated TLS verification, fetched a second-stage payload, and executed it as a background process. The second stage acted as a cross-platform infostealer targeting browser histories and cryptocurrency wallet data, establishing persistence on Windows, macOS, and Linux. Despite the malicious nature of these packages, Socket's proactive measures ensured that installations of affected packages were quickly flagged and blocked, limiting potential damage. The incident underscores the importance of vigilant monitoring and control over dependency installations to safeguard against similar supply chain threats.

In May 2026, GitHub revealed a security breach involving the exfiltration of approximately 3,800 internal repositories through a compromised VS Code extension, highlighting the risks posed by third-party editor extensions. The malicious extension, Nx Console 18.95.0, was distributed via trusted marketplaces before its removal, underscoring the need for enhanced security measures to protect developer environments. Socket has responded by extending its Firewall protection to editor extensions, offering install-time and update-time control points to block malicious extensions before they are downloaded or run. This solution, now available in beta for Socket Enterprise customers, applies enforcement at the proxy level without requiring additional software deployment on developer devices, supporting both VS Code Marketplace and Open VSX ecosystems. By filtering requests and blocking flagged extensions, Socket Firewall aims to close the gap in extension security, ensuring that only safe extensions are installed and reducing the risk of credential theft and other security threats.

Socket has introduced Manifest Alerts, a feature that identifies and flags risks in project manifests, specifically focusing on missing lockfiles, which was developed in response to the Axios npm compromise. This feature addresses the challenge of reproducibility in dependency resolution, where the absence of a lockfile means that a project's dependency tree can change over time with each installation, leading to potential security risks. Manifest Alerts highlight issues in the manifest itself, allowing teams to identify projects where the resolved dependency graph cannot be reproduced from the repo files. Unlike Dependency Alerts, which are tied to specific packages, Manifest Alerts focus on the project setup and configuration decisions that affect how dependencies are installed. This feature not only identifies missing lockfiles but also provides package-manager-specific guidance for generating them, and allows teams to manage alerts by creating tickets or ignoring them, with further developments planned to address other issues like malformed manifests and outdated lockfiles.

A new npm package, [email protected], has emerged as a potential adversarial test case for AI-based malware scanners, according to Socket Threat Research. Unlike previous campaigns involving Mini Shai-Hulud, Miasma, and Hades, which embedded fake prompt-injection headers, this package appears to specifically target AI-based scanning systems by exploiting their vulnerabilities. It features a massive `index.js` file filled with policy-triggering prompt content, fake override instructions, and repetitive comments, all designed to confuse and exhaust AI models. The package aims to manipulate AI-assisted review processes by using context flooding, staged obfuscation, and scanner-targeting strings to trigger refusals and hide executable code. While the package may lean more towards protestware or trolling, its construction highlights the emerging threat of adversarial tactics against AI systems used in malware analysis, demonstrating the need for enhanced security measures in AI-enabled scanners to handle such complex evasive strategies effectively.

The Socket Threat Research team uncovered a sophisticated malware campaign utilizing WebAssembly embedded in Visual Studio Code extensions, targeting crypto developers through trojanized clones of legitimate extensions on the Open VSX marketplace. These extensions contain a WebAssembly module, obfuscated using ChaCha20 encryption, which activates upon extension launch to communicate with the Solana blockchain for command-and-control instructions. The malware exploits a JavaScript host environment to execute OS-specific download-and-run commands, bypassing traditional detection methods by storing its C2 instructions on the blockchain, rather than hardcoded servers, making it resilient to takedown efforts. This campaign is attributed with medium confidence to the GlassWorm developer, known for utilizing Solana transaction memos as a dead-drop mechanism and employing a novel approach by using TinyGo-compiled WebAssembly for obfuscation. The affected extensions were quickly removed from the registry following the discovery, and defenders are advised to monitor for suspicious activities, such as unexpected blockchain interactions and process executions, to mitigate potential threats.

Socket has introduced a seamless integration with Linear, allowing for efficient management of alerts related to malicious packages and vulnerabilities directly in an issue tracker. This integration automates the process of converting alerts into Linear issues, setting the appropriate priority, assignee, and labels without manual input. The connection is established through OAuth from the Socket dashboard, enabling admins to authorize specific Linear teams for issue creation. Users can create issues from any alert, link them back to the alert, and even automate ticketing through customizable rules that determine when and how issues are created and updated. This ensures that issues remain current as alerts change, fostering a two-way sync between Socket and Linear. The integration, currently in beta, is available to Business and Enterprise plan users, and offers similar functionality to Socket's existing Jira integration, including assignee support and automated ticketing rules.

Claude Fable 5, a highly anticipated AI model from Anthropic, was swiftly suspended just three days after its launch due to a directive from the US government concerning export control, which blocked access by foreign nationals and halted its use for all customers. The suspension, attributed to concerns over a potential method for bypassing the model's safeguards, led to widespread customer dissatisfaction, particularly among those who had paid for access and began integrating it into complex projects. Anthropic, while complying with the directive, contested the technical basis for the action, arguing that the identified issue was a minor, non-universal vulnerability common in defensive software engineering and not a significant threat. Despite positioning Opus 4.8 as a temporary replacement, users expressed frustration over the perceived downgrade and the abrupt disruption of their work. The situation has sparked broader discussions on AI oversight and the implications of government intervention in commercial AI products, as Anthropic navigates the fallout from the abrupt halt of a model that had seen considerable demand and was considered a significant advancement in software engineering.

Socket's Threat Research Team discovered a network of 152 Chrome Web Store extensions, masquerading as "live wallpaper" new-tab tools, which are built on a shared codebase but distributed across 38 different publisher accounts. These extensions, which have a collective install base of approximately 105,000, claim not to collect user data but are found to log information such as IP addresses and ISP details, sharing this data with Google AdSense, DoubleClick, and other advertising partners. A subset of these extensions deceptively manipulates Google organic search attribution, making extension-driven traffic appear as organic search traffic to inflate perceived popularity and trustworthiness for advertisers. The extensions also contain an anti-forensic IndexedDB wipe routine, a privacy policy contradiction concerning data collection, and a monetization strategy through ad-monetized brand pages. This operation is characterized by its deceptive traffic measurement, undisclosed telemetry, and resistance to takedown due to its distribution across numerous publisher identities. The family-wide behavior includes deceptive traffic laundering, a privacy policy contradiction, and the use of a shared extension template across multiple infrastructures, indicating a widespread and organized attempt to manipulate web traffic analytics and monetize through ad networks.

Socket, a company focused on securing the software supply chain, has appointed Andrew Becherer as its first Chief Information Security Officer to enhance its security measures across over 27,000 organizations. With a background in leading security programs at major SaaS companies like Datadog and Iterable, and experience with AI systems through his startup Staris AI, Andrew brings a wealth of expertise in infrastructure security and managing risks associated with open-source software. His role will involve integrating security into Socket’s operations and strengthening its products, ensuring they meet the needs of enterprises that rely on open-source tools without compromising trust. Socket CEO Feross Aboukhadijeh emphasizes the significance of this appointment, noting that Andrew’s understanding of both defending against and building solutions for supply chain risks makes him an ideal leader for their security efforts. As the company expands, they are actively recruiting across various departments to further their mission of protecting the open-source ecosystem.

Replit is transforming the software development process by integrating AI agents that can recommend and install open source packages, thus accelerating the path from idea to functional software. As this shift increases the risk of supply chain attacks due to automatic dependency management, Replit has partnered with Socket to incorporate Socket Firewall into its platform, enhancing security by evaluating and blocking potentially harmful packages during the build process. This proactive approach addresses threats like typosquatting and malicious dependencies by integrating threat intelligence directly into the installation path, ensuring that developers are protected without hindering their workflow. Since implementing the firewall, Replit has blocked around 8,000 packages daily, highlighting the effectiveness of this security measure. This partnership aims to maintain rapid software creation while safeguarding against the amplified risks introduced by AI-assisted development, ensuring that builders can continue to innovate with confidence.

An npm tooling bug mistakenly applied security-holder metadata to several one-character packages, such as letters and numbers, resulting in the assignment of placeholder versions like 0.0.1-security and the latest dist-tag being moved to this placeholder. Despite this, older versions of the packages remained accessible, and there was no public evidence of package compromise. npm acknowledged the error, attributing it to a tooling mistake, and has since corrected the issue. Developers are advised to check their lockfiles for any placeholder versions to ensure their dependency manager resolved the intended version rather than the temporary placeholder. This incident underscores the impact of registry metadata on software supply chains, as incorrect metadata can lead to confusion even without changes to the actual package code. As of June 9, 2026, npm confirmed that the affected packages are no longer marked incorrectly.

The Socket Threat Research team has identified a new wave of supply chain attacks involving malicious PyPI packages that expand on previous campaigns like Mini Shai-Hulud, Miasma, and Hades. This latest wave includes 23 newly identified PyPI artifacts, featuring bioinformatics packages, typosquat-style packages, and AI-themed packages. The threat actors are rapidly evolving their tactics, employing diverse delivery mechanisms such as .pth startup hooks, trojanized native extensions, and payload discovery across Python’s sys.path. A notable variant, langchain-core-mcp, separates the loader from the payload, complicating detection efforts. The campaign targets developer workstations and CI/CD environments to steal valuable credentials and secrets. The malicious packages are part of a broader supply chain attack strategy that continues to adapt, making it crucial for defenders to focus on execution paths and credential exposure while employing robust detection and response measures.

A coordinated attack on the Python Package Index (PyPI) involved the compromise of 37 malicious wheel artifacts across 19 packages, utilizing a setup.pth file to execute a JavaScript payload via the Bun runtime during Python startup. This attack, identified by Socket's AI malware detection system, is part of the Shai-Hulud/Miasma lineage, characterized by its cross-runtime capabilities and sophisticated obfuscation techniques. The payload targets sensitive developer and CI/CD credentials, leveraging GitHub for exfiltration with new Hades-themed markers. This incident highlights the vulnerabilities in trusted package channels, as attackers exploited Python's .pth file execution to trigger malicious activities upon installation. The attack affected established bioinformatics tools and underscores the need for vigilance in managing dependencies and credentials across ecosystems. PyPI has quarantined some compromised releases, and affected organizations are advised to remove malicious versions, rebuild environments, and rotate credentials to mitigate potential damage.

RubyGems and Bundler 4.0.13 have introduced an opt-in cooldown feature to enhance security by delaying the installation of newly published gem versions, thus providing a time-based defense against supply chain attacks. This feature allows developers to set a specific number of days during which newly released gem versions are not resolved, aiming to mitigate risks associated with immediate adoption of malicious packages. The cooldown is unset by default, allowing existing projects to continue using the latest versions unless explicitly configured otherwise. This approach reflects a wider trend among package managers to introduce time-based controls that can prevent the rapid spread of compromised dependencies. While it offers protection against malicious versions, it also has trade-offs, potentially delaying legitimate releases, including urgent security updates. Bundler's implementation leverages timestamp metadata from RubyGems.org's compact index, ensuring that only versions released outside the cooldown window are resolved. The feature complements RubyGems' other security improvements like mandatory 2FA and AI-assisted vulnerability scanning, and it can be configured in various ways, including through Gemfile settings, global configs, and environment variables.

pnpm 11.5 addresses a false-positive downgrade warning by treating npm staged publishing approvals as strong trust evidence, reflecting npm's ongoing tightening of package publishing controls after incidents involving credential theft and token abuse. This update resolves an issue where the trustPolicy: no-downgrade setting misclassified staged publishing as a downgrade from trusted publishing due to incorrect inference from the _npmUser field, as reported by Kevin Deng. The fix involves recognizing staged publishing approval as its own strong trust signal, thereby preventing misclassification and reducing unnecessary alerts. This change underscores the need for clearer registry metadata to accurately convey publishing security properties, especially as npm introduces multiple release paths like classic, trusted, and staged publishing modes. Additionally, pnpm 11.5 includes other supply chain updates, such as improved handling of minimumReleaseAgeExclude, preservation of the integrity field for remote dependencies, and enhanced browser-based 2FA handling for specific npm operations, showcasing adaptations to npm's evolving security model.

A federal audit reveals significant issues with the management of the National Vulnerability Database (NVD) by the National Institute of Standards and Technology (NIST), highlighting a backlog of unprocessed vulnerabilities and a lack of a strategic plan, despite previous public assurances of improvement. The U.S. Department of Commerce Office of Inspector General found that NIST set unrealistic deadlines without the capacity to meet them and spent taxpayer money on duplicated vulnerability enrichment work, exacerbating the backlog. NIST's decision to transition to a risk-based model for analyzing vulnerabilities left many records without necessary data for automated management, further contributed to delays, particularly for critical vulnerabilities. The audit also uncovered poor communication and coordination between NIST and the Cybersecurity and Infrastructure Security Agency (CISA), which resulted in redundant efforts and wasted resources. Despite these findings, NIST pushed back against some of the audit's framing but agreed to implement recommendations for improvement, including creating strategic and backlog management plans and enhancing coordination with CISA.

Socket has uncovered a malicious npm supply chain attack affecting @redhat-cloud-services packages, employing tactics similar to the Shai-Hulud campaign, which involves install-time execution, credential harvesting, and potential propagation to downstream systems. The attack leverages a preinstall hook to run obfuscated malware upon npm install, targeting sensitive information like GitHub Actions secrets, npm tokens, cloud credentials, and more, with encrypted exfiltration and fallback mechanisms via GitHub. The malicious packages execute a JavaScript loader that decrypts and runs hidden payloads, evading static review. The threat is exacerbated by the public availability of Shai-Hulud attack tooling, complicating attribution. Socket's analysis notes that the malware aims to collect extensive credentials and possibly facilitate further supply chain attacks, prompting ongoing analysis and public tracking of affected packages.