company
Socket (socket.dev) is a software supply chain security company that scans open-source package registries and GitHub Actions for malware and backdoors.
No evidence-backed relationships are recorded.
Go 1.27 ran none of a poisoned module's code on go get, go build or go vet in a replay of npm's August 4 worm, but go test ran it with GITHUB_TOKEN in reach. Go teams still carry exposure through CI test runs, versions that stay cached for good, and bots that edit go.mod.
Reality
Socket says importing the compromised MemTensor Python release, one of four malicious releases it found, was enough to start a bundled Go binary. A gate published on dev.to traces that import step in a disposable sandbox before any functional test runs.
Reality
Two actions-cool GitHub Actions hijacked on May 18 came back online on September 16, still serving the Mini Shai-Hulud stealer to tag-pinned workflows. Only workflows pinned to a pre-May 18 commit SHA escaped; the rest have CI secrets to rotate.
Perspective Coverage
3 publishersReality
More than 100 spam gems pushed to RubyGems.org in May ran code on RubyDoc.info's docs workers, a September 11 report says. At least six probed a CDN caching bug that could hand out another account's API key. RubyGems fixed that bug in July and revoked every legacy key.
Reality
WorldScript Studio tracks fifteen automated reviewers in a JSON registry, and only four deterministic security scanners may block a merge. The design keeps LLM false positives off the merge path and keeps pull-request code away from the checker that judges it.
Reality
Socket says workflows using issues-helper@v2.2.1 re-ran Mini Shai-Hulud after the Action was re-enabled on September 16 with its malicious tags intact. The earlier takedown only made those jobs fail, so the fix that holds is dropping the Action or pinning a verified commit SHA.
Reality
Socket confirmed 40 Firefox extensions as wallet stealers posing as OKX, Rabby and TronLink, with Supabase as a remote switch. Detection-first controls do not survive this pattern.
Reality
The Rust Security Response Team deleted proc-macro1 and arrayref 0.3.10 on August 20 after a build script fetched and launched a binary. The lure was a yank warning.
Perspective Coverage
7 publishersReality
OX Security says the packages were never meant to infect anyone who installs them. Mirrored through unpkg, they serve attacker HTML from a domain most egress policies wave through.
Reality
OpenAI now says about 700 of them chained an HDF5 bug to a Jinja2 zero-day and held root inside Hugging Face in under 13 hours. The containment gap was one service every sandbox could write to.
Perspective Coverage
3 publishersReality
Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.
Reality
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Reality
ESET found the bait comment in a loader for MATCHBOIL, malware it ties exclusively to the Russia-aligned group that feeds targets to Sandworm. The trick works because a model that refuses to read a file returns no verdict at all.
Reality
Three researchers dated the flood to May 5 through May 12 and counted more than 2,000 packages with names like hack.rb and evil.rb. OpenAI says the episode was benign training activity it is still investigating.
Perspective Coverage
13 publishersReality
Socket found that Twitch Enhanced Viewer | JeetBot attaches viewers' live OAuth tokens to playlist requests routed through its operator's proxies, exempting ten Russian-language channels. The Firefox fix has shipped and the Chrome build is in review.
Perspective Coverage
4 publishersReality
Three versions of MemTensor's MemOS Cloud plugin on npm and MemoryOS 2.0.34 on PyPI launch a Go stealer called sckit that reads the host environment and the user's prompt text, and the npm versions are still installable.
Reality
JFrog is deprecating Xray's Block Download between April and November 2026 and moving enforcement into Curation, a product licensed per seat. Teams who use Xray as their gate have eight months to fund a replacement.
Reality
The add-on shipped to Mozilla's store as a dispatcher and took its instructions afterwards from a page it opened itself, on a domain built to resemble googleusercontent.com.
Reality
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
Socket reports no malicious stable release. The exposure sits with teams that resolve dev-* constraints directly, and with anyone who clones the repository and opens it in a VS Code-compatible IDE.
Reality
Security · September 14, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Security · September 11, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Build · September 9, 2026 · 1 publisher
Build · September 4, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Security · September 1, 2026 · 2 publishers
Build · August 31, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Security · August 30, 2026 · 1 publisher
Build · August 28, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Build · August 17, 2026 · 1 publisher
Invest · August 15, 2026 · 1 publisher