Socket

Massive npm Supply Chain Attack: Qix’s Account Compromised, Billions of Weekly Downloads at Risk

• Cybercriminals

Massive npm Supply Chain Attack: Qix’s Account Compromised, Billions of Weekly Downloads at Risk

Do Son September 9, 2025 0

A key npm maintainer's account was compromised, leading to a supply chain attack. Malicious code in popular packages is stealing crypto during transactions.

Malicious npm Packages Impersonate Flashbots SDKs to Steal Ethereum Wallet Credentials

• Malware

Malicious npm Packages Impersonate Flashbots SDKs to Steal Ethereum Wallet Credentials

Do Son September 9, 2025 0

A new report reveals a supply chain attack on Ethereum. Four malicious npm packages impersonating Flashbots were used to steal private keys and mnemonic seeds from developers.

XORIndex: North Korea’s Evolving Supply Chain Malware Targets npm Ecosystem Again

• Malware

XORIndex: North Korea’s Evolving Supply Chain Malware Targets npm Ecosystem Again

Do Son July 15, 2025 0

North Korean APTs are using XORIndex malware in a new npm supply chain attack, infiltrating developers via 67 malicious packages to steal crypto wallets and credentials.

Malicious Firefox Extensions Unmasked: Fake Games, VPNs, & Calendar Tools Hijack Traffic, Steal Crypto & OAuth Tokens

• Cybercriminals

Malicious Firefox Extensions Unmasked: Fake Games, VPNs, & Calendar Tools Hijack Traffic, Steal Crypto & OAuth Tokens

Do Son July 7, 2025 0

Socket uncovers a sprawling network of malicious Firefox extensions, masquerading as games, VPNs, and tools, to hijack affiliate links, steal OAuth tokens, and reroute traffic.

Alert: Malicious Python Package “psslib” Typosquats passlib, Shuts Down Windows Systems

• Malware

Alert: Malicious Python Package “psslib” Typosquats passlib, Shuts Down Windows Systems

Do Son June 26, 2025 0

A malicious Python package, 'psslib,' typosquats the popular 'passlib' library, forcing immediate Windows system shutdowns, causing data loss for unsuspecting developers.

Stealthy npm Supply Chain Attack: Typosquatting Leads to Remote Code Execution and Data Destruction

• Malware

Stealthy npm Supply Chain Attack: Typosquatting Leads to Remote Code Execution and Data Destruction

Do Son June 3, 2025 0

A new npm supply chain attack, "xlsx-to-json-lh," uses typosquatting to enable remote code execution, silently awaiting a "kill switch" to delete project directories.

Malicious Python Packages Exploited Gmail as Covert Command-and-Control Channels

• Malware

Malicious Python Packages Exploited Gmail as Covert Command-and-Control Channels

Do Son May 2, 2025 0

Socket discovers Python packages abusing Gmail SMTP for covert C2 tunnels, evading firewalls and exfiltrating data through trusted email infrastructure.