|
Malicious Checkmarx Artifacts Found in Official KICS Docker Repository and Code Extensions
|
Socket Research Team |
2026-04-22 |
2,911 |
4
|
|
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
|
Socket Research Team |
2026-04-22 |
1,195 |
1
|
|
Introducing Reports: An Extensible Reporting Framework for Socket Data
|
André Staltz |
2026-04-21 |
886 |
--
|
|
Socket for Jira Is Now Available
|
Jeppe Hasseriis |
2026-04-20 |
602 |
--
|
|
Socket Named Top Sales Organization by RepVue
|
Sarah Gooding |
2026-04-17 |
366 |
--
|
|
NIST Officially Stops Enriching Most CVEs as Vulnerability Volume Skyrockets
|
Sarah Gooding |
2026-04-17 |
1,465 |
--
|
|
Socket Selected for OpenAI's Cybersecurity Grant Program
|
Sarah Gooding |
2026-04-16 |
467 |
--
|
|
Feross on the 10 Minutes or Less Podcast: Nobody Reads the Code
|
Sarah Gooding |
2026-04-14 |
186 |
--
|
|
108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure
|
Kush Pandya |
2026-04-13 |
3,881 |
6
|
|
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
|
Sarah Gooding |
2026-04-11 |
605 |
3
|
|
Don't Kill the Goose That Lays the Golden Eggs
|
Sarah Gooding |
2026-04-10 |
528 |
--
|
|
Feross on TBPN: How North Korea Hijacked Axios
|
-- |
2026-04-08 |
254 |
--
|
|
Attackers Are Impersonating a Linux Foundation Leader in Slack to Target Open Source Developers
|
-- |
2026-04-08 |
972 |
--
|
|
uv: Python's New High-Speed Package Manager Promises to Simp...
|
Sarah Gooding |
2026-04-07 |
1,128 |
5
|
|
Microsoft Releases Open Source Toolkit for AI Agent Runtime Security
|
-- |
2026-04-07 |
1,074 |
--
|
|
North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads
|
-- |
2026-04-07 |
2,680 |
2
|
|
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
|
-- |
2026-04-03 |
1,806 |
3
|
|
Fluent Assertions Faces Backlash After Abandoning Open Sourc...
|
Sarah Gooding |
2026-04-02 |
1,082 |
3
|
|
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
|
-- |
2026-04-02 |
857 |
5
|
|
Node.js Drops Bug Bounty Rewards After Funding Dries Up
|
-- |
2026-04-02 |
902 |
--
|
|
The Hidden Blast Radius of the Axios Compromise
|
-- |
2026-04-01 |
3,065 |
6
|
|
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
|
-- |
2026-03-31 |
1,986 |
2
|
|
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
|
Socket Research Team |
2026-03-27 |
3,756 |
--
|
|
TeamPCP Partners With Ransomware Group Vect to Target Open Source Supply Chains
|
Sarah Gooding |
2026-03-26 |
757 |
--
|
|
Widespread GitHub Campaign Uses Fake VS Code Security Alerts to Deliver Malware
|
Sarah Gooding and Peter van der Zee |
2026-03-25 |
1,127 |
--
|
|
GitHub Activates Push Protection by Default After Detecting ...
|
Sarah Gooding |
2026-03-24 |
668 |
2
|
|
Tech's $90B Ghost Engineer Problem: Stanford Study Finds 9.5...
|
Sarah Gooding |
2026-03-24 |
772 |
4
|
|
The Cyber Security Council Podcast: Securing Modern Applicat...
|
Sarah Gooding |
2026-03-24 |
408 |
2
|
|
Maven Central Adds Sigstore Signature Validation
|
Sarah Gooding |
2026-03-24 |
715 |
3
|
|
Opengrep Launches Playground in Alpha: A Faster, More Stable...
|
Sarah Gooding |
2026-03-24 |
1,040 |
2
|
|
Michigan TypeScript Founder Successfully Runs Doom Inside Ty...
|
Sarah Gooding |
2026-03-24 |
879 |
2
|
|
5 Malicious npm Packages Typosquat Solana and Ethereum Libraries to Steal Private Keys
|
Kush Pandya |
2026-03-24 |
1,691 |
--
|
|
TeamPCP Is Systematically Targeting Security Tools Across the OSS Ecosystem
|
Sarah Gooding |
2026-03-24 |
886 |
5
|
|
TypeScript 6.0 Released: The Final JavaScript-Based Version
|
Sarah Gooding |
2026-03-23 |
637 |
--
|
|
Spam-tastic! npm Registry Swamped by Bizarre John Wick Frenz...
|
Bradley Meck Farias |
2026-03-22 |
394 |
5
|
|
Trivy Supply Chain Attack Expands to Compromised Docker Images
|
Philipp Burckhardt |
2026-03-22 |
366 |
5
|
|
Socket and Seal Security Collaborate to Fix Critical npm Ove...
|
Sarah Gooding |
2026-03-20 |
660 |
2
|
|
Safari 18.4 Ships 3 New JavaScript Features from the TC39 Pi...
|
Sarah Gooding |
2026-03-20 |
601 |
2
|
|
Gmail For Exfiltration: Malicious npm Packages Target Solana...
|
Kirill Boychenko |
2026-03-20 |
928 |
4
|
|
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
|
Socket Research Team |
2026-03-20 |
1,361 |
3
|
|
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
|
Philipp Burckhardt |
2026-03-20 |
3,346 |
250
|
|
ENISA Publishes Technical Advisory on Secure Use of Package Managers
|
Sarah Gooding |
2026-03-19 |
862 |
6
|
|
GlassWorm Sleeper Extensions Activate on Open VSX, Shift to GitHub-Hosted VSIX Malware
|
Philipp Burckhardt and Peter van der Zee |
2026-03-18 |
3,676 |
--
|
|
TC39 Advances Temporal to Stage 4 Alongside Several ECMAScript Proposals
|
Sarah Gooding |
2026-03-16 |
706 |
--
|
|
Browserslist-rs Gets Major Refactor, Cutting Binary Size by ...
|
Sarah Gooding |
2026-03-12 |
672 |
3
|
|
Developer Accuses Tencent of Copyright Violation After Pytho...
|
Sarah Gooding |
2026-03-12 |
1,204 |
3
|
|
6 Malicious Packagist Themes Ship Trojanized jQuery and FUNNULL Redirect Payloads
|
Kush Pandya |
2026-03-12 |
2,517 |
--
|
|
GCVE Launches Decentralized Publishing Ecosystem for Vulnerability Disclosure
|
Sarah Gooding |
2026-03-12 |
1,103 |
--
|
|
Node.js Moves to Annual Major Releases Starting with Node 27
|
Sarah Gooding |
2026-03-11 |
981 |
--
|
|
Recent Trends in Malicious Packages Targeting Discord - Sock...
|
Socket Research Team |
2026-03-10 |
734 |
1
|
