Socket Threat Research

Malicious PyPI Package Wave Spreads Evolving Supply Chain Attacks

• Malware

Malicious PyPI Package Wave Spreads Evolving Supply Chain Attacks

Do Son June 9, 2026 0

A new malicious PyPI package wave highlights evolving supply chain attacks. Learn how to protect your CI/CD pipelines from credential theft.

Supply Chain Siege: 84 TanStack Packages Compromised to Steal GitHub Secrets

• Malware

Supply Chain Siege: 84 TanStack Packages Compromised to Steal GitHub Secrets

Do Son May 12, 2026 0

Urgent: 84 TanStack npm packages hijacked to harvest GitHub Actions secrets. Over 12M weekly downloads impacted. Audit your CI/CD pipelines and rotate tokens.

Malicious Packagist Themes Target Vietnamese OphimCMS Sites with Trojanized JS

• Malware

Malicious Packagist Themes Target Vietnamese OphimCMS Sites with Trojanized JS

Do Son March 17, 2026 0

Socket uncovers a Packagist supply chain attack targeting Vietnamese OphimCMS streaming sites with trojanized themes linked to sanctioned entity FUNNULL.

Malicious “Hex Visualizer” Chrome Extension Targeting imToken Users

• Cybercriminals

Malicious “Hex Visualizer” Chrome Extension Targeting imToken Users

Do Son March 10, 2026 0

Socket researchers uncover "ImToken Chromophore," a malicious Chrome extension using fake branding and homoglyphs to steal crypto wallet seed phrases.

Malicious PHP Packages Found Hidden in Laravel Ecosystem

• Malware

Malicious PHP Packages Found Hidden in Laravel Ecosystem

Do Son March 6, 2026 0

Socket researchers uncover a Packagist supply chain attack where fake Laravel utility packages secretly install a persistent Remote Access Trojan (RAT).

Malicious NuGet Packages Weaponize ASP.NET Identity for Production Backdoors

• Malware

Malicious NuGet Packages Weaponize ASP.NET Identity for Production Backdoors

Do Son February 25, 2026 0

Socket researchers uncover a NuGet supply chain attack using "NCryptYo" to hijack ASP.NET apps. Attackers inject backdoors into production authorization layers.

“CL Suite” Deception: Malicious Chrome Extension Steals 2FA Secrets and Meta Business Data

• Malware

“CL Suite” Deception: Malicious Chrome Extension Steals 2FA Secrets and Meta Business Data

Do Son February 17, 2026 0

"CL Suite" Chrome extension steals Meta Business 2FA seeds & data. Attackers bypass security even after uninstall. Reset 2FA immediately.

“SymPy” Imposter: Typosquatting Attack Turns Math Library into Crypto Miner

• Malware

“SymPy” Imposter: Typosquatting Attack Turns Math Library into Crypto Miner

Do Son January 23, 2026 0

Malicious PyPI package "sympy-dev" impersonates SymPy to install XMRig miners via fileless execution. Check your dependencies immediately.

Fake Productivity Tools: 5 Malicious Chrome Extensions Hijack Enterprise Sessions

• Malware

Fake Productivity Tools: 5 Malicious Chrome Extensions Hijack Enterprise Sessions

Do Son January 19, 2026 0

Socket discovers 5 malicious Chrome extensions posing as productivity tools. They steal session tokens & block security teams. 2,300+ enterprise users at risk.

Malicious Chrome Extension Drains Crypto via Secret API Keys

• Malware

Malicious Chrome Extension Drains Crypto via Secret API Keys

Do Son January 14, 2026 0

Malicious Chrome extension "MEXC API Automator" hijacks API keys to drain crypto wallets. Russian-linked malware hides withdrawal permissions. Remove now.