|
fsnotify Maintainer Dispute Sparks Supply Chain Concerns
|
Sarah Gooding |
2026-05-08 |
1,352 |
1
|
|
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
|
Wenxin Jiang and Marvin Fleischer and Jonah Ghebremichael |
2026-05-08 |
607 |
--
|
|
TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack
|
Socket Research Team |
2026-05-11 |
7,030 |
6
|
|
Socket Named to Rising in Cyber 2026 List of Top Cybersecurity Startups
|
Sarah Gooding |
2026-05-12 |
266 |
--
|
|
Packagist Urges Immediate Composer Update After GitHub Actions Token Leak
|
Sarah Gooding |
2026-05-13 |
603 |
--
|
|
GemStuffer Campaign Abuses RubyGems as Exfiltration Channel Targeting UK Local Government
|
Joseph Edwards |
2026-05-13 |
3,825 |
--
|
|
Popular node-ipc npm Package Infected with Credential Stealer
|
Socket Research Team |
2026-05-14 |
2,650 |
3
|
|
TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks
|
Sarah Gooding |
2026-05-14 |
710 |
--
|
|
Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor
|
Kush Pandya |
2026-05-19 |
2,564 |
--
|
|
Active Supply Chain Attack Compromises @antv Packages on npm
|
Socket Research Team |
2026-05-19 |
10,666 |
4
|
|
Coruna Respawned: Compromised art-template npm Package Leads to iOS Browser Exploit Kit
|
Joseph Edwards |
2026-05-20 |
7,102 |
--
|
|
Socket Raises $60M Series C at a $1B Valuation to Help Enterprises Build Securely With AI
|
Feross Aboukhadijeh |
2026-05-20 |
551 |
--
|
|
Socket raises $60M Series C at $1B valuation led by Thrive Capital to secure AI-driven software development
|
Feross Aboukhadijeh |
2026-05-20 |
1,813 |
3
|
|
npm Invalidates Granular Access Tokens as Mini Shai-Hulud Sweeps the Registry
|
Sarah Gooding |
2026-05-21 |
1,477 |
--
|
|
Malicious Postinstall Hook Found Across 700+ GitHub Repositories, Including Packagist and Node.js Projects
|
Socket Research Team |
2026-05-22 |
1,356 |
18
|
|
AI Has Taken Over Open Source
|
André Staltz |
2026-05-22 |
1,356 |
3
|
|
Laravel Lang Compromised with RCE Backdoor Across 700+ Versions
|
Socket Research Team |
2026-05-23 |
6,365 |
9
|
|
TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io
|
Socket Research Team |
2026-05-24 |
5,697 |
2
|
|
OSV Withdraws 157 Malware Reports After Automated False Positives Hit npm and PyPI
|
Sarah Gooding |
2026-05-27 |
659 |
--
|
|
Feross on TBPN: Socket's Series C and the State of Software Supply Chain Security
|
Sarah Gooding |
2026-05-27 |
1,834 |
--
|
|
Malicious NuGet Package Impersonates Sicoob SDK to Exfiltrate Banking Certificates and Passwords
|
Kirill Boychenko |
2026-05-28 |
2,654 |
--
|
|
Rust Moves to Restrict LLM Use in Contributions After Months of Internal Debate
|
Sarah Gooding |
2026-05-31 |
1,288 |
--
|
|
Famous Chollima Targets PHP Developers Through Compromised Packagist Package
|
Kirill Boychenko |
2026-05-31 |
1,667 |
--
|
|
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
|
Socket Research Team |
2026-06-01 |
4,194 |
--
|
|
Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog
|
Sarah Gooding |
2026-06-03 |
2,143 |
--
|
|
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
|
Sarah Gooding |
2026-06-04 |
681 |
--
|
|
RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems
|
Sarah Gooding |
2026-06-05 |
890 |
--
|
|
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
|
Socket Research Team |
2026-06-07 |
2,293 |
--
|
|
Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels
|
Kirill Boychenko |
2026-06-08 |
2,072 |
2
|
|
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
|
Sarah Gooding |
2026-06-09 |
488 |
--
|
|
Socket Partners with Replit to Block Malicious Packages in AI-Powered Development
|
Feross Aboukhadijeh |
2026-06-10 |
379 |
--
|
|
Andrew Becherer Joins Socket as Chief Information Security Officer
|
Sarah Gooding |
2026-06-11 |
485 |
--
|
|
152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic
|
Kush Pandya |
2026-06-12 |
4,624 |
--
|
|
US Government Forces Anthropic to Pull Claude Fable Days After Launch
|
Sarah Gooding |
2026-06-13 |
719 |
--
|
|
Socket for Linear Is Now Available
|
Jeppe Hasseriis |
2026-06-15 |
586 |
--
|
|
GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions
|
Joseph Edwards |
2026-06-15 |
3,923 |
--
|
|
npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners
|
Jean-Charles Noirot Ferrand |
2026-06-16 |
2,004 |
--
|
|
Introducing Manifest Alerts
|
André Staltz |
2026-06-16 |
602 |
--
|
|
Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions
|
John Tuckner |
2026-06-17 |
705 |
--
|
|
140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack
|
Socket Research Team |
2026-06-17 |
2,970 |
--
|
|
Socket MCP Adds Org Alerts, Threat Feed Review, and Package Inspection
|
John Tuckner |
2026-06-18 |
1,150 |
--
|
|
Introducing Repository Access Permissions and Custom Roles
|
Joe Werle |
2026-06-19 |
781 |
--
|
|
GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts
|
Sarah Gooding |
2026-06-20 |
1,196 |
--
|
|
The Code You Didn't Write Is Still Yours to Defend
|
Brad Arkin |
2026-06-23 |
863 |
--
|
|
Frontier AI Is Now Critical Infrastructure
|
Sarah Gooding |
2026-06-24 |
1,631 |
--
|
|
Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem
|
Socket Research Team |
2026-06-25 |
2,226 |
--
|
|
Rolldown Pulls Rust React Compiler Integration After Binary Size Increase
|
Sarah Gooding |
2026-06-26 |
969 |
1
|
|
Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages
|
Socket Research Team |
2026-06-26 |
2,094 |
--
|
|
Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates
|
Kirill Boychenko |
2026-06-29 |
3,008 |
--
|
|
Risky Biz Podcast: AI Agents Are Raising the Stakes for Software Supply Chain Security
|
Sarah Gooding |
2026-06-30 |
210 |
--
|
