Feross

Inside the GitHub Infrastructure Powering North Korea’s Cont... Socket Threat Research maps a rare inside look at OtterCookie’s npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korean op...

The Socket Threat Research Team continues to track North Korea’s Contagious Interview operation as it systematically infiltrates the npm ecosystem. socket.dev/blog/north-k... @socket.dev

More malicious Chrome extensions.

Stay vigilant!

Glad to hear it!

Update: at time of writing Eleventy core (0.x, 1.x, 2.x, 3.x, 4.x prereleases) and our official plugins are still unaffected.

(Compromised package count was updated to 834 from 533 in the latest @socket.dev update)

There is an ongoing npm security event.

At time of writing, Eleventy core and our official suite of plugins are unaffected.

Ha, thanks. One of those situations where I'm only partially happy to be right. Mostly just glad that we're building something helpful.

*this is fine meme*

🤯 The number of affected packages in the Shai-Hulud npm attack has now reached 770. We’re continuing to investigate and will keep the blog post updated:

socket.dev/blog/shai-hu...

that’s a scary read tbh

We have updated this list to include more than 500 packages and 700+ affected versions, as well as a technical analysis of the attack. socket.dev/blog/shai-hu....

cc: @campuscodi.risky.biz @typescript.fm @bleepingcomputer.com @theregister.com

Here we go again

Introducing Webhook Events for Alert Changes - Socket Add real-time Socket webhook events to your workflows to automatically receive software supply chain alert changes in real time.

Read the full announcement here: socket.dev/blog/introdu...

Webhooks for Alert Changes just dropped 🎉

No more refreshing dashboards. Socket now pushes every new, updated, or cleared alert straight into your workflow in real time.

Perfect way to wrap Launch Week: Ruby reachability, Certified Patches, Bun/vlt, OpenVSX… and now this ⚡️

Introducing Socket Scanning for OpenVSX Extensions - Socket Socket now scans OpenVSX extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools...

Read the full announcement here: socket.dev/blog/introdu...

IDE extensions are a silent nightmare.

VS Code extensions get full access to your code and creds, and attackers have already slipped malware into VS Code Marketplace and OpenVSX.

So Socket now scans OpenVSX extensions before they ever hit your machine. 🔍⚡️

🚀 Big news for JavaScript teams: Socket now supports Bun and vlt in beta.

You no longer have to choose between innovation and security. Commit a bun.lock or vlt-lock.json and Socket gives you full supply chain protection.

Thanks for sharing!

👀

Certified Patches are available today in closed beta for enterprise teams (JavaScript/TypeScript).
Want early access? Contact sales@socket.dev or your customer success manager.

Patches live locally in your repo, apply during builds, and require zero workflow changes. No registry proxies. No new infra. Patches belong to you - there's no lock-in.
Pair Certified Patches with Socket Reachability and you get a clear path to zero exploitable CVEs instantly.

Recent supply chain attacks have shown us a hard truth: updating dependencies can sometimes be risky. With Certified Patches, you can now eliminate CVEs instantly without upgrading or pulling in new, unvetted code.

🚀 Day 2 of Socket Launch Week:

Today we’re introducing a major shift in how developers fix vulnerabilities: Socket Certified Patches.
One-click, safe-by-design remediation for vulnerable dependencies.

npm Malware Campaign Uses Adspect Cloaking to Deliver Malici... Malicious npm packages use Adspect cloaking and fake CAPTCHAs to fingerprint visitors and redirect victims to crypto-themed scam sites.

🚨 New npm malware campaign uncovered: 7 malicious packages use Adspect cloaking and fake CAPTCHAs to hide redirects to #crypto scam sites.

Read the full analysis → socket.dev/blog/npm-mal...

This is a novel technique attackers are using to distribute browser-executed malware through npm.

cc: @campuscodi.risky.biz

🚀 Day Two of Socket Launch Week!

We’re launching @socket.dev Certified Patches—a new way to eliminate vulnerabilities instantly without upgrading your package versions or pulling in risky new code.

Tiny, human-reviewed fixes that give teams a clean path to zero exploitable CVEs.

Yes, we support Go in the enterprise version of the firewall. You can reach out to us at sales@socket.dev to get access.

Woo!!!

🫶🏼 #socket

Reachability for Ruby Now in Beta - Socket Reachability analysis for Ruby is now in beta, helping teams identify which vulnerabilities are truly exploitable in their applications.

7/ Dive in here: socket.dev/blog/reachab...

6/ You can try it today:
• Precomputed reachability in the Socket Dashboard
• Full application reachability via CLI with socket scan create --reach

This is another step toward bringing precise, function-level reachability to every major ecosystem 🚀

5/ It’s conservative by design: when Ruby gets wild, we don’t guess. We err on the side of safety so real issues never slip through.