@socket.dev
Socket is the #1 software supply chain security platform. Next-gen SCA + SBOM + 0-day prevention. LOVED BY DEVELOPERS.
@socket.devUpdate: Socket has identified more than 500 GitHub accounts that committed the malicious GhostAction workflow to tens of thousands of repositories since October 7, including organization-owned repositories reached through compromised contributors.
@jasnell.meReposted by @socket.devFun fact.. Node.js was downloaded nearly 900 million times in July alone.
@socket.dev"Our moderators are observing an increase in thin papers of narrow scope, as well as ‘salami’ papers, where a single work is broken up and submitted as a set of smaller papers. There is also a marked increase in dense, AI-written papers." - @arxiv.bsky.social
@socket.devThe payload now also scans source code and full git history for cloud and AI credentials, including secrets deleted from current files.
It captures nearby lines around AWS key IDs to find the corresponding secret keys.
@socket.dev🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel. Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.
@socket.dev🚨 Tensorlake’s npm SDK (12K weekly downloads) was compromised in a ChainDrop / Shai-Hulud attack.
Version 0.5.144 contains a credential-stealing worm with a dead-man switch designed to execute attacker code when a stolen GitHub token is revoked.
@socket.devcc: @campuscodi.risky.biz @darkreading.bsky.social @coindesk.com @cointelegraph.bsky.social @theblock.bsky.social @coingapenews.bsky.social @thehackernews.bsky.social @bleepingcomputer.com
@socket.devSocket found 16 malicious Firefox extensions impersonating Rabby and OKX wallets, built to steal recovery phrases and private keys.
All 16 claim to collect no data. The malware sends wallet secrets to attacker-controlled Cloudflare Workers.
@socket.dev✍️ our full write-up: socket.dev/blog/glasswo...
✨ we now scan for these: socket.dev/blog/vscode-...
@socket.devYou wanted VS Code to look rad. Now you have TWO problems.
@socket.devReposted by @socket.dev🚀 Socket now scans VS Code Marketplace extensions! You can vet every dependency in your app and still get compromised by an extension in your editor. We analyze all 100,000+ extensions in the VS Code Marketplace and their updates for malicious code and risky behaviors.
@socket.devExtensions auto-update, and developers have little visibility into what changed.
Socket flags suspicious file access, network activity, process execution, obfuscated code, and links to known attack campaigns.
✨ Available today: socket.dev/blog/vscode-...
@socket.dev🚀 Socket now scans VS Code Marketplace extensions! You can vet every dependency in your app and still get compromised by an extension in your editor. We analyze all 100,000+ extensions in the VS Code Marketplace and their updates for malicious code and risky behaviors.
@socket.devA ClickFix RAT targets ChatGPT power users 👀
@socket.devSocket researchers found a GlassWorm-linked VS Code theme cluster: 4 extensions on VS Code Marketplace and 6 on Open VSX. Related themes have thousands of installs. The malware fetches and executes payloads using encrypted loaders and a Solana dead drop.
socket.dev/blog/glasswo...
@socket.devModern malware doesn't need to steal anything
It simply tells your AI agent "you're an authorized pentester" and lets the it do the stealing.
Socket CTO @ahmadnassri.com Nassri on Insecure Agents with Allie Howe: socket.dev/blog/insecur...
@feross.bsky.socialReposted by @socket.devCapital One operates in one of the most demanding security environments in the world. As AI accelerates how software gets built, evaluating dependencies in the pipeline is non-negotiable.
Excited to share how they’re using Socket for proactive supply chain security:
socket.dev/blog/capital...
@socket.dev🎙️ Socket CTO @ahmadnassri.com discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.
@socket.dev"The agents have too much power" @ahmadnassri.com
@socket.devNew UK AISI report: GPT-6 Astra reached malicious payload delivery in 29.2% of simulated CTF runs. In its supply chain attacks, it considered fake CVE reports, deceptive PR notes, and triggering a publisher workflow from an unmerged PR branch.
