The Curious Engineer

All blogs / Security

Socket

socket.dev/blog

Read the Socket blog for supply chain security, practical insights on reachability, and the vulnerabilities that actually matter.

Security

’23’24’25’26
Posts
59 from 21 Feb 2023 to 30 Oct 2026
Posting
weekly (57 in the last year)
Kind
company blog
Feed
https://socket.dev/api/blog/feed.atom

2026 57

  1. Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
  2. OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
  3. Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
  4. Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
  5. Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
  6. eMudhra, Brotli, and the Long Tail of a Security Fix
  7. New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
  8. Cloudflare Introduces a Faster TypeScript Compiler Written in Rust
  9. PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
  10. PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
  11. LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
  12. vlt 1.5.0 Adds Agent Skills Management
  13. Rust 1.100 Will Add Dependency Cooldowns to Cargo
  14. Deno Goes the Way of the Dinosaur
  15. Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings
  16. Front Lines Podcast: What Founders Get Wrong When Pitching CISOs
  17. Socket for Origin Now AvailableSecurity NewsProductOct 14, 2026
  18. Agent Baseline Publishes Security Reference Architecture for Software FactoriesSecurity NewsOct 13, 2026
  19. New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud CredentialsThreat ResearchSecurity NewsOct 9, 2026
  20. arXiv Is Rate Limiting Authors Following a Flood of AI Slop SubmissionsSecurity NewsOct 9, 2026
  21. TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackThreat ResearchSecurity NewsOct 8, 2026
  22. 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsThreat ResearchSecurity NewsOct 7, 2026
  23. Introducing Socket Scanning for VS Code Marketplace ExtensionsProductOct 6, 2026
  24. Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSXThreat ResearchSecurity NewsOct 2, 2026
  25. Insecure Agents Podcast: How to Keep AI Agents From Bypassing Security ControlsSecurity NewsOct 1, 2026
  26. Securing the Financial Frontier: How Capital One Uses Socket for Open Source SecuritySecurity NewsCompany NewsOct 1, 2026
  27. New AISI Report Details How GPT-6 Astra Turned CTF Challenges Into Supply Chain AttacksSecurity NewsSep 30, 2026
  28. upm Launches as a Fast, Tiny Package Manager Written in TypeScriptSecurity NewsSep 29, 2026
  29. Socket Joins New OpenJS Program to Fund Node.js Security WorkCompany NewsSep 25, 2026
  30. Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-HuludSecurity NewsSep 24, 2026
  31. MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain AttackThreat ResearchSecurity NewsSep 23, 2026
  32. Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google AccountsThreat ResearchSecurity NewsSep 23, 2026
  33. Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open SourceSecurity NewsSep 22, 2026
  34. Happy Birthday, Shai-HuludSecurity NewsSep 18, 2026
  35. PolinRider Spreads Through Compromised GitHub Accounts and PackagistThreat ResearchSecurity NewsSep 17, 2026
  36. GitHub Actions Adds cache-mode to Limit Cache Poisoning RiskSecurity NewsSep 16, 2026
  37. Jerod Santo Joins Socket as Head of MediaCompany NewsSep 14, 2026
  38. Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot ServiceThreat ResearchSecurity NewsSep 11, 2026
  39. Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI AttackSecurity NewsSep 10, 2026
  40. Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet DataThreat ResearchSecurity NewsSep 9, 2026
  41. GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in TestingSecurity NewsSep 4, 2026
  42. pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%Security NewsSep 1, 2026
  43. Microsoft Teams Notifications Are Now Available in SocketProductSep 1, 2026
  44. 13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet SeedsThreat ResearchSecurity NewsAug 31, 2026
  45. 6 AppSec CTOs Debate Open Source Supply Chain Security at Black HatSecurity NewsAug 31, 2026
  46. Socket Now Protects the Microsoft Edge Extension EcosystemProductAug 28, 2026
  47. When Autonomous Agents Escape: Why Socket Signed the Cyber Defense Open LetterSecurity NewsAug 28, 2026
  48. OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain AttackThreat ResearchSecurity NewsAug 28, 2026
  49. 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing PayloadsThreat ResearchSecurity NewsAug 27, 2026
  50. Socket for ClickUp Is Now AvailableProductAug 26, 2026
  51. Socket for Asana Is Now AvailableProductAug 25, 2026
  52. Open VSX Unblocks Extension IDs Used in Malware CampaignSecurity NewsAug 24, 2026
  53. PHP and Composer Support Is Now in BetaProductAug 21, 2026
  54. Popular Rust Crates Compromised in Build-Time Supply Chain AttackThreat ResearchSecurity NewsAug 20, 2026
  55. Socket Now Protects the Firefox Extension EcosystemProductAug 20, 2026
  56. 77 Firefox Extensions Linked to Crypto Wallet and Credential TheftThreat ResearchSecurity NewsAug 19, 2026
  57. Raised $125M

2024 1

  1. Fortune Cyber 60

2023 1

  1. SOC 2 Type 2