RSS feed

socket.dev

New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs

by

Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.

0
5

Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

by
0
6

TanStack npm Packages Compromised

by
2
43

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Attack

by
0
31
1

Supply Chain Attack on Axios Pulls Malicious Dependency from npm

by

Comments

0
4

Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets

by

Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

1
6
1

AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach

by

Lobsters.

18
90
1

Socket Joins the OpenJS Foundation

by
0
4

AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach

by
18
20
1

PyPI Package Impersonates SymPy to Deliver Cryptomining Malware

by
0
28
1

PyPI Package Impersonates SymPy to Deliver Cryptomining Malware

by
0
4
1

Malicious Chrome Extension Injects Hidden SOL Fees Into Solana Swaps

by
0
9

The Changelog Podcast: Practical Steps to Stay Safe on npm

by
0
4

Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys

by
0
7

Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape

by
0
6

Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages

by
0
6

libxml2 Maintainer Ends Embargoed Vulnerability Reports, Citing Unsustainable Burden

by

Libxml2’s solo maintainer drops embargoed security fixes, highlighting the burden on unpaid volunteers who keep critical open source software secure.

3
56

wget to Wipeout: Malicious Go Modules Fetch Destructive Payload

by
0
1

Node.js Takes Steps Towards Removing Corepack - Socket

by
0
1