Flux
Couleur d'accent
Toutes les sources

Socket

174 articles Flux RSS
Cybersécurité Programmation
Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
Cybersécurité Programmation

Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX

Socket uncovered a theme cluster spanning four Visual Studio Marketplace and six Open VSX extensions, including two confirmed malicious extensions and a high-confidence link to GlassWorm. The Socket Threat Research team identified two suspicious VS Code themes still available on the Visual Studio Marketplace at the time of writing: Coca-Cola Christmas and Aurora Borealis Studio Theme. Both present themselves as polished color themes, contain executable JavaScript despite primarily providing…

Socket
Securing the Financial Frontier: How Capital One Uses Socket for Open Source Security
Cybersécurité Programmation

Securing the Financial Frontier: How Capital One Uses Socket for Open Source Security

The financial sector operates in a hyper-targeted, unforgiving threat landscape. As the guardians of sensitive data and global economic infrastructure, financial institutions frequently face sophisticated cyber threats and some of the most rigorous regulatory scrutiny in the world. Yet, like every modern enterprise, they rely heavily on open source software to drive innovation and speed. Securing that open source foundation without slowing down engineering teams is a massive challenge. That is…

Socket
Insecure Agents Podcast: How to Keep AI Agents From Bypassing Security Controls
Cybersécurité Programmation

Insecure Agents Podcast: How to Keep AI Agents From Bypassing Security Controls

A coding agent blocked from installing a package may try another way to download it. In this episode of the Insecure Agents podcast recorded at Black Hat, Socket CTO Ahmad Nassri joins host Allie Howe to discuss how agents’ determination to finish a task can lead them to bypass security controls, and how Socket Firewall changes what they see before an install begins. Nassri describes cases where agents responded to blocked installs by fetching package tarballs directly from a CDN, overriding…

Socket
New AISI Report Details How GPT-6 Astra Turned CTF Challenges Into Supply Chain Attacks
Cybersécurité Programmation

New AISI Report Details How GPT-6 Astra Turned CTF Challenges Into Supply Chain Attacks

Earlier this month, Socket reported that GPT-6 Astra tried to plant malicious code in simulated open source projects while working on an unrelated cybersecurity challenge. The UK AI Security Institute (AISI), which had access to the model before its release, first disclosed the behavior in OpenAI’s system card. AISI has now published a dedicated technical report documenting how Astra chose targets outside the challenge’s scope, developed payloads, and tried to get maintainers to accept its…

Socket
upm Launches as a Fast, Tiny Package Manager Written in TypeScript
Cybersécurité Programmation

upm Launches as a Fast, Tiny Package Manager Written in TypeScript

There's a new package manager in town, and this one fits in about 250 KB. Pooya Parsa, a longtime Nuxt contributor and creator of Nitro and UnJS, has introduced upm, a TypeScript package manager for the npm registry that uses Node.js's built-in networking, worker threads, compression, and filesystem tools. It has a JavaScript API, reads supported .npmrc settings, and can install from several other package managers' lockfiles. With so many package managers already out there, do we really need…

Socket
Socket Joins New OpenJS Program to Fund Node.js Security Work
Cybersécurité Programmation

Socket Joins New OpenJS Program to Fund Node.js Security Work

Socket has joined the OpenJS Foundation’s new Security Stewardship Program as an inaugural partner, helping fund vulnerability research, triage, patching, and security releases across the JavaScript ecosystem. The program launches with an initial focus on Node.js, where the security workload is growing faster than the funding available to support it. “AI is driving a sharp rise in vulnerability reports, pushing many open source projects to shut down their bug bounty programs. The bottleneck is…

Socket
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Cybersécurité Programmation

Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud

Update, September 25, 2026: both actions-cool/issues-helper and actions-cool/maintain-one-comment have been disabled on GitHub again, so workflows referencing them now fail at job setup instead of running the payload. Two actions-cool GitHub Actions, issues-helper and maintain-one-comment, were compromised and disabled during the May 2026 Mini Shai-Hulud campaign. Both became reachable again on September 16, 2026, and their release tags still point to malicious code, so every workflow that…

Socket
Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts
Cybersécurité Programmation

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

Socket identified a Firefox extension that ships with no hardcoded malicious code and fetches a remote payload after installation to silently automate Google account takeover, targeting Portuguese- and Spanish-speaking users since September 11, 2026. Socket's Threat Research team identified a malicious Firefox extension posing as a utility for identity verification before opening protected PDF documents. The extension, pdf-para-texto@extensao.local, was published to the Firefox Add-ons store on…

Socket
MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack
Cybersécurité Programmation

MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack

The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Its main GitHub repository has about 11,500 stars and 1,100 forks. Four malicious releases, three of the npm package @memtensor/memos-cloud-openclaw-plugin and one of the PyPI package MemoryOS, each currently the latest version on its registry, drop cross-platform Go binaries that search developer home directories for secrets and report to servers under skyleen[.]fr.…

Socket
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Cybersécurité Programmation

Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source

Lovable is beginning to replace Vite inside its cloud preview environments with OJ, a Rust-based build tool created for the demands of running around one million short-lived development sandboxes per day. The company reported that OJ reduced median sandbox acquisition time from 14.5 seconds to 3 seconds and cut the memory used by the dev server process by roughly 6.5x in a controlled production rollout. OJ arrives as part of the trend toward rewriting JavaScript tooling in Rust. Other examples…

Socket
Happy Birthday, Shai-Hulud
Cybersécurité Programmation

Happy Birthday, Shai-Hulud

This week marks one year since an attacker pushed a malicious version of @ctrl/tinycolor to npm, kicking off the worst year for npm security on record. At the time, the package was downloaded more than two million times a week. Within a day the same code was spreading on its own across dozens of packages, and then into CrowdStrike's npm namespace. It was the first known self-propagating worm in the npm ecosystem, and it has not really stopped since. The tinycolor compromise put software supply…

Socket
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Cybersécurité Programmation

PolinRider Spreads Through Compromised GitHub Accounts and Packagist

Socket researchers identified malicious code in the dev-main version of visanduma/nova-two-factor, a Packagist package with more than 700,000 cumulative downloads, as the PolinRider campaign continues to spread through compromised developer accounts and Git repositories. The Socket Threat Research Team continues to track malicious activity associated with PolinRider. In our July research post, we provided initial technical details about this persistent campaign, which distributes malware across…

Socket
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
Cybersécurité Programmation

GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk

GitHub has added cache-mode to GitHub Actions, a new setting that limits how workflows and jobs can access the Actions cache. It targets cache poisoning, the technique attackers used to compromise the Ultralytics PyPI package in 2024 and the TanStack npm packages in May 2026. Cache poisoning works because an entry written to the shared Actions cache in one context can be restored and run in another. An attacker who gains write access to a cache key that a trusted workflow later reads can plant…

Socket
Jerod Santo Joins Socket as Head of Media
Cybersécurité Programmation

Jerod Santo Joins Socket as Head of Media

We need to talk. Supply chain attacks are going parabolic in both frequency and impact. There are so many hacks now that we gussy ‘em up with names like GemStuffer, SANDWORM_MODE, and TrapDoor just to keep track of the onslaught. (Remember Heartbleed? The O.G. (Original Gussy)) We’ve also got frontier models escaping their sandboxes to hack third parties, zero-click worms spreading through WeChat without any user interaction, AI-discovered zero days being used by criminal enterprises, and so…

Socket
Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service
Cybersécurité Programmation

Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service

Socket’s Threat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons (twitchenhancedviewer@example.com, 552 users). Both listings are live at time of writing. Current builds (v85.x) forward the token inline…

Socket
Esc