Socket

Critical Vulnerability in NestJS Devtools: Localhost RCE via... A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).

🚨 Critical RCE in @nestjs/devtools-integration:
A broken sandbox + CSRF lets any website trigger code execution on your dev machine if the dev server is running.

Full disclosure: socket.dev/blog/nestjs-...

Introducing License Overlays: Smarter License Management for... Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.

🚀 Day 5 of Launch Week!

We're introducing License Overlays: fine-tune Socket’s license detection to match your team’s policy.

Handle edge cases, preserve attribution, and reduce false positives with precision.

socket.dev/blog/introdu...

🚀 Day 4 of Launch Week: Introducing Rust support in Socket!

Search any crate on socket.dev — no login required.
Enterprise users get early access to experimental SBOM generation & full supply chain protection.

🦀 More Details → socket.dev/blog/introdu... #RustLang cc: @thisweekinrust.bsky.social

Announcing Precomputed Reachability Analysis in Socket - Soc... Socket’s precomputed reachability slashes false positives by flagging up to 80% of vulnerabilities as irrelevant, with no setup and instant results.

⚡️ Instant Analysis: Results are precomputed and cached for popular dependencies, so they're available immediately.

🧘‍♀️ Zero-Overhead: No additional scans, no agents, no performance impact.

🔒 Privacy-Preserving: We never need access to your source code.

Available now →
socket.dev/blog/announc...

Announcing Precomputed Reachability Analysis in Socket - Soc... Socket’s precomputed reachability slashes false positives by flagging up to 80% of vulnerabilities as irrelevant, with no setup and instant results.

🚀 Day 3 of Socket Launch Week: We're launching Precomputed Reachability Analysis!

Socket takes a radically different approach, using just your manifest files (package-lock.json, requirements.txt, pom.xml, etc.) to slash false positives by flagging up to 80% of CVEs as irrelevant.

Socket Now Protects the Chrome Extension Ecosystem - Socket Socket is launching experimental protection for Chrome extensions, scanning for malware and risky permissions to prevent silent supply chain attacks.

Day 2 of Socket Launch Week: DOUBLE LAUNCH 🚀
Browser extensions are a growing attack surface for nearly every organization.

Today, we’re launching an experimental release of Chrome extension scanning to detect malware and risky updates.

🧩 Learn more → socket.dev/blog/socket-...

🚀 Day 2 of Socket Launch Week: Introducing Socket MCP for Claude Desktop!

Add one-click dependency security scanning to your Claude conversations. No CLI, no configuration files: just install and ask #Claude to check your dependencies.

Try it now → socket.dev/blog/introdu...

Introducing Scala and Kotlin Support in Socket - Socket Socket now supports Scala and Kotlin, bringing AI-powered threat detection to JVM projects with easy manifest generation and fast, accurate scans.

🚀 We’re kicking off a big launch week at Socket ahead of Black Hat, dropping a new feature every day this week!

Day 1: Scala & Kotlin Support is now in beta!
AI-powered supply chain threat detection for JVM projects with fast, accurate scans.

socket.dev/blog/introdu... #Java

npm ‘is’ Package Hijacked in Expanding Supply Chain Attack -... The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.

npm package `is` hijacked in expanding supply chain attack
@sarahgooding.bsky.social @socket.dev
socket.dev/blog/npm-is-...

#ECMAScript #JavaScript

JupiterOne Secures Immutable Infrastructure with Socket’s St... JupiterOne uses Socket to cut false positives, enforce CI/CD policy, and streamline security in a lean, automated, immutable infrastructure.

Check out our case study to learn how JupiterOne partnered with Socket to:

⚡️ Integrate policy-driven security into CI/CD
⚡️ Cut false positives with reachability analysis
⚡️ Achieve audit-ready compliance automatically
⚡️ Scale security without additional overhead

socket.dev/case-study/j...

Vibe coding with LLMs is making developers faster, but also creating new attack surfaces. Socket CEO @feross.bsky.social talks with Joel de la Garza of a16z about the future of AI-assisted software and supply chain security.
🎙️ Check out the full episode: socket.dev/blog/ai-a16z...

Not pretty, not Windows-only: npm phishing attack laces popular packages with malware The "is" package was infected with cross-platform malware after a scam targeting maintainers The popular npm package "is" was infected with cross-platform malware, around the same time that linting utility packages used with the prettier code formatter were infected with Windows-only malware.…

Not pretty, not Windows-only: npm phishing attack laces popular packages with malware

Toptal’s GitHub Organization Hijacked: 10 Malicious Packages... Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.

🚨 Supply chain attack alert: A threat actor gained access to Toptal's GitHub org, making 73 repos public and injecting malicious payloads into 10+ npm packages.

Full research: socket.dev/blog/toptal-... #NodeJS #JavaScript

JupiterOne Secures Immutable Infrastructure with Socket’s St... JupiterOne uses Socket to cut false positives, enforce CI/CD policy, and streamline security in a lean, automated, immutable infrastructure.

Check out our case study to learn how JupiterOne partnered with Socket to:

⚡️ Integrate policy-driven security into CI/CD
⚡️ Cut false positives with reachability analysis
⚡️ Achieve audit-ready compliance automatically
⚡️ Scale security without additional overhead

socket.dev/case-study/j...

"We tried a variety of different solutions, but Socket turned out to be the most cost-effective and efficient, replacing all the others."

- Kenneth Kaye, Lead Security Engineer at JupiterOne

Surveillance Malware Hidden in npm and PyPI Packages Targets... Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.

🚨 New Threat Research: We uncovered 4 malicious packages (3 on npm, 1 on PyPI) with 56,000+ downloads, all delivering surveillance malware capable of keylogging, screen capture, and webcam access.

Here’s what we found: socket.dev/blog/surveil... #NodeJS #JavaScript #Python

npm ‘is’ Package Hijacked in Expanding Supply Chain Attack -... The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.

🚨 Attackers have hijacked the npm 'is' package (~2.8M weekly downloads), adding a malicious JS loader. This compromise is linked to the recent npm phishing campaign. Read our update on this ongoing supply chain attack: socket.dev/blog/npm-is-... #NodeJS #JavaScript

npm ‘is’ Package Hijacked in Expanding Supply Chain Attack -... The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.

🚨 Attackers have hijacked the npm 'is' package (~2.8M weekly downloads), adding a malicious JS loader. This compromise is linked to the recent npm phishing campaign. Read our update on this ongoing supply chain attack: socket.dev/blog/npm-is-... #NodeJS #JavaScript

Critical Vulnerability in Popular npm form-data Package Used... A critical flaw in the popular npm form-data package could allow HTTP parameter pollution, affecting millions of projects until patched versions are a...

🚨 A critical vulnerability in the widely used npm form-data package could allow HTTP Parameter Pollution, potentially impacting millions of projects. The package sees 100M+ downloads weekly.

Details → socket.dev/blog/critica... #NodeJS #JavaScript

Active Supply Chain Attack: npm Phishing Campaign Leads to P... Popular npm packages like eslint-config-prettier were compromised after a phishing attack stole a maintainer’s token, spreading malicious updates.

"Hours after we reported on the npm phishing campaign using the typosquatted npnjs com site, we’re now seeing the first major fallout: popular npm packages, including eslint-config-prettier and eslint-plugin-prettier, were compromised" #eslint #npm #nodejs

socket.dev/blog/npm-phi...

Bun 1.2.19 Adds Isolated Installs for Better Monorepo Suppor... Bun 1.2.19 introduces isolated installs for smoother monorepo workflows, along with performance boosts, new tooling, and key compatibility fixes.

Bun 1.2.19 introduces isolated installs for monorepos, smarter package management, and 5x faster Bun.sql. 🎉 Congrats to @jarredsumner.com and all the @bun.sh contributors: socket.dev/blog/bun-1-2... #NodeJS

Be aware and don't fall for this ☝️

Thanks for that feedback! I'll share it with the team. The AI package summary tab there could use some improvements, especially for packages where there is no README. We're looking into it, and thank you for reporting the issue. 🙏

Active Supply Chain Attack: npm Phishing Campaign Leads to P... Popular npm packages like eslint-config-prettier were compromised after a phishing attack stole a maintainer’s token, spreading malicious updates.

🚨 Active supply chain attack on npm:
Multiple Prettier tooling packages were compromised through the phishing campaign we published about just hours ago. Watch out for more compromised accounts and malicious packages.

Follow-up: socket.dev/blog/npm-phi... #nodejs #npm

🚨 npm phishing alert!
Attackers are sending emails from spoofed support@npmjs.org addresses linking to a typosquatted clone site (npnjs.com) to steal credentials. This attack is designed to hijack npm accounts. Careful with those email links: socket.dev/blog/npm-phi... #nodejs #JavaScript

Knip Hits 500 Releases with v5.62.0, Improving TypeScript Co... Knip hits 500 releases with v5.62.0, refining TypeScript config detection and updating plugins as monthly npm downloads approach 12M.

✂️ Knip, the popular open source tool for finding unused code and dependencies, just hit 500 releases with v5.62.0. This release features #TypeScript config refinements and plugin updates. Congrats to @larskappert.nl & all the Knip contributors! 🎉 socket.dev/blog/knip-hi... #JavaScript

Open Source Maintainers Feeling the Weight of the EU’s Cyber... The EU Cyber Resilience Act is prompting compliance requests that open source maintainers may not be obligated or equipped to handle.

EU’s Cyber Resilience Act isn’t fully in effect yet but #OSS maintainers are already bracing for compliance requests. cURL is among the first to receive one (from a Fortune 500 company using a 2 year old version.)
What happens when companies treat volunteers like vendors? socket.dev/blog/oss-mai...

Open Source Maintainers Feeling the Weight of the EU’s Cyber... The EU Cyber Resilience Act is prompting compliance requests that open source maintainers may not be obligated or equipped to handle.

EU’s Cyber Resilience Act isn’t fully in effect yet but #OSS maintainers are already bracing for compliance requests. cURL is among the first to receive one (from a Fortune 500 company using a 2 year old version.)
What happens when companies treat volunteers like vendors? socket.dev/blog/oss-mai...

Crates.io Implements Trusted Publishing Support - Socket Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.

🦀 Rust is the latest open source ecosystem to adopt Trusted Publishing, joining PyPI and RubyGems in moving away from long-lived API tokens.

📦 Crates can now be published using short-lived credentials from trusted CI workflows.

socket.dev/blog/crates-... #RustLang #OpenSource