Socket

Malicious packages uploaded to the Rust registry (crates.io) impersonated legitimate developer tools, stealing cryptocurrency by executing a stealthy, multi-stage attack…

A malware campaign using seven npm packages hijacked browsers to redirect users to cryptocurrency scams, employing cloaking and anti-analysis techniques…

Seven malicious npm packages used the Adspect cloaking service to distinguish between security researchers and real targets, redirecting only the…

Malicious packages on NuGet, uploaded by shanhai666, contain hidden payloads set to activate between 2027 and 2028, targeting database systems…

A self-propagating worm named 'Shai-Hulud' has compromised at least 187 npm packages, starting with @ctrl/tinycolor and spreading to include modules…

A massive supply-chain attack on the NPM ecosystem was quickly neutralized, preventing a catastrophic security incident despite malicious updates reaching…

A software supply-chain attack compromised nearly two dozen npm packages with two billion weekly downloads, making it one of the…

A malicious npm package named "nodejs-smtp" impersonates the legitimate nodemailer library, compromising cryptocurrency wallets by altering transaction details to redirect…

Six major password managers with millions of users are vulnerable to unpatched clickjacking attacks, which can expose sensitive data like…

Anthropic introduced Claude Connectors, enabling seamless integration with external data sources, including cloud services and desktop apps, to enhance functionality.…