Socket Security

Sicoob SDK Banking Malware Exploits NuGet Developer Channels

• Malware

Sicoob SDK Banking Malware Exploits NuGet Developer Channels

Do Son June 3, 2026 0

A dangerous Sicoob SDK banking malware campaign triggers a major NuGet supply chain attack. Learn how it exfiltrates private financial certificates.

Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat

• Malware

Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat

Do Son May 25, 2026 0

Security researchers have exposed a malicious Go module backdoor hidden inside the shopsprint/decimal package that executes code using stealthy DNS TXT records.

Malicious JS Lifecycle Hooks Found Hiding Inside PHP Composer Packages

• Malware

Malicious JS Lifecycle Hooks Found Hiding Inside PHP Composer Packages

Do Son May 23, 2026 0

Socket exposes a clever cross-ecosystem supply chain attack targeting PHP packages by hiding a malicious JS postinstall backdoor inside package.json.

Poisoned Protocol: dYdX Supply Chain Attack Injects RATs into npm & PyPI

• Malware

Poisoned Protocol: dYdX Supply Chain Attack Injects RATs into npm & PyPI

Do Son February 10, 2026 0

Critical dYdX supply chain attack: Compromised npm & PyPI packages steal seed phrases & deploy RATs. Remove @dydxprotocol/v4-client-js immediately.

Scam Alert: “Amazon Ads Blocker” Extension Hijacks Creator Commissions

• Cybercriminals

Scam Alert: “Amazon Ads Blocker” Extension Hijacks Creator Commissions

Do Son January 30, 2026 0

"Amazon Ads Blocker" extension exposed for stealing creator revenue. It hijacks affiliate links to divert commissions to the developer. Uninstall it now.

Destructive npm Packages Disguised as Utilities Trigger Remote System Wipes on Demand

• Malware

Destructive npm Packages Disguised as Utilities Trigger Remote System Wipes on Demand

Do Son June 9, 2025 0

Two malicious npm packages, express-api-sync and system-health-sync-api, act as remote-controlled time bombs, wiping entire directories with a single POST request.

PyPI Supply Chain Attack Steals Solana Private Keys via Covert Monkey-Patching

• Malware

PyPI Supply Chain Attack Steals Solana Private Keys via Covert Monkey-Patching

Do Son June 2, 2025 0

A sophisticated PyPI supply chain attack, "cappership," steals Solana private keys by monkey-patching, leveraging transitive dependencies and blockchain exfiltration.