Socket Blog

Disclosure: I’m the founder of https://socket.dev npm stats lag. We observed installs while the malicious versions were live for hours before removal. Affected releases we saw: [email protected], @duckdb/[email protected], @duckdb/[email protected], @duckdb/[email protected]. Same payload as yesterday’s Qix compromise. Recommend pinning and avoiding those versions, reviewing diffs, and considering a temporary policy not to auto-adopt fresh patch releases on critical packages until they age.

Would be great if npm->github->microsoft partnered up with https://socket.dev to get a crude filter and take down any obvious malicious/spam packages.

Trust is great; but even trust can be broken either on purpose or accidentally over time. There's a great example of a well-known NPM package which was taken over accidentally by a hacker, and the thousands / millions of dependent packages and apps were totally vulnerable. Check out https://socket.dev for a better NPM solution (not affiliated w/ them at all), though AI's definitely going to accentuate this problem 1000x.

> Because I'm confident nothing will happen if it does Well, best of luck. 1. Amazon has shipped backdoored packages - https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ 2. Scanners like Trivy have been compromised - https://socket.dev/blog/trivy-under-attack-again-github-actions-compro… 3. Redhat is shipping backdoored FOSS packages - https://access.redhat.com/security/vulnerabilities/RHSB-2026-006 4. Even fake and malicious ESLint packages have been published - https://gbhackers.com/eslint-package-attack/

Not aware of any NPM native ways but here are few community tools: - https://socket.dev/blog/introducing-socket-firewall - https://github.com/lirantal/npq - https://bun.com/docs/pm/security-scanner-api source: https://github.com/bodadotsh/npm-security-best-practices?tab=readme-ov…

These days compromised packages are often detected automatically by software that scans all packages uploaded to npm like https://socket.dev or https://snyk.io. So I imagine it's still useful to have those services scan these packages first, before they go out to the masses. Measures like this also aren't meant to be "final solutions" either, but stop-gaps. Slowing the spread can still be helpful when a large scale attack like this does occur. But I'm also not entirely sure how much that weighs against potentially slowing the discovery as well. Ultimately this is still a repository problem and not a package manager one. These are merely band-aids. The responsibility lies with npm (the repository) to implement proper solutions here. > The responsibility lies with

Tips to protect yourself from supply-chain attacks in the JavaScript ecosystem: - Don't update dependencies unless necessary - Don't use `npm` to install NPM packages, use Deno with appropriate sandboxing flags - Sign up for https://socket.dev and/or https://www.aikido.dev - Work inside a VM

https://socket.dev/ does a good job in detecting malicious packages in npm. In their FAQ[1], they mention that they have plans to expand to PyPI as well. [1]: https://docs.socket.dev/docs/faq

This sucks. Supply chain is such an issue. Even tho we don't currently target any npm releases, I make use of socket.dev to monitor my project by creating an npm release for it. But my project BrowserBox (lightweight virtualized web browser) only uses ~800 dependencies including all descendents, with only 19 top-level deps (cool your heels non-JavaScript folks, this is comparatively lightweight for a full stack boing). I'm considering just snapshotting all 800 deps into a @browserbox namespace at npm. And then tracking any vulnerabilities discovered and patching the fixes. It sounds crazy, but that's where we are. At least that way I "own" all the dependencies and can guarantee (up to company security at least) that we don't have supply chain vulns on the Node/JS side. https://socket.dev https://github.com/BrowserBox/BrowserBox

Love Socket! A lot of folks (think most) were loading the compromised package through another package, @ledgerhq/connect-kit-loader [1], via a CDN call [2]. Would be great if Socket could pick up on this because Socket's @ledgerhq/connect-kit-loader page [3] doesn't include any warning. [1]: https://socket.dev/npm/package/@ledgerhq/connect-kit-loader [2]: https://github.com/LedgerHQ/connect-kit/blob/main/packages/connect-kit… [3]: https://socket.dev/npm/package/@ledgerhq/connect-kit-loader/overview/1…

Check out https://socket.dev/ Been super impressed by their approach to identifying and securing codebases against supply chain attacks (and I believe they have a special deal for open source repos too!)

Does anyone know if Socket[0] can help here? [0] https://socket.dev/

A recently announced tool called Socket is trying to do exactly that scoring approach : https://socket.dev/

ehh nobody has to reveal themselves... but I don't want to necessarily consume random packages from anonymous authors either... I think that a sanction list would make sense, perhaps https://socket.dev/ could use it as a data point for alerts if they are not already

Wow, awesome to see what you're working on with Socket. I feel it's a much-needed tool. One question though: how do you think https://socket.dev will compare to https://snyk.io/ and other similar tools? How do you differentiate yourself from competition in the space? (I've been a big fan of yours since early WebTorrent days.)

I absolutely love that you added a telemetry issue! I'm linking your page about it from the Debian privacy issues page. https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues

Hey team, great to see someone tackle this project, and the idea to scan for new potential issues based on the code that changed is cool Initial impressions when visiting the website though is I can't understand how it works exactly, for example the learn more page at https://socket.dev/integrations says Socket helps improve the posture, but it would be good to explain (perhaps with screenshots an actual example?) of it catching an issue.

In agreement with frodd above. Dependencies and supply chain attacks are probably the greatest risk to a lot of software orgs, as they run them across all their environments: Development (with secrets and other valuable artefacts on developer VMs), CI/CD pipelines which may have access tokens to production (and other) environments, and production itself. Notably even security companies are being impacted by this[0]. The scale of these attacks has amplified quite significantly the past three years, but are not solely exclusive to the javascript ecosystem [1] or even just namesquatting/typosquatting [2]. The resolution is broader security awareness, "onion layered" security controls and implementing simple non-burden inducing processes and policies. Sometimes not updating (what was wrong with the previous version of a dependency if there was no immediate vulnerability or production issue caused by it?) or having a two week cool down for updates (which some supply chain tooling natively supports) can appease some security functions through clear communication of the supply chain risk etc. If anyone has interest in courses aligned to your org on improving developer and broader engineering management awareness on this, e-mails in my profile :). [0] - https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrik… [1] - https://orca.security/resources/blog/hades-pypi-supply-chain-attack/ [2] -…

This attack is pretty bad, but as shown by the tiny ROI for the attacker mentioned in this article (about $500 so far: https://intel.arkm.com/explorer/entity/61fbc095-f19b-479d-a037-5469aba… this really isn't quite as ecosystem-catastrophic as it sounds, for a few reasons: * Major attacks on large packages like this are caught fairly quickly - a few hours in this case - making the vulnerable window _relatively_ small. * NPM locks installed dependencies by default, against both the version & a hash of the content, so you'll only install the new malicious version if you happen to be adding or updating this dependency specifically within the window this version is still live. It's effectively sort-of TOFU. If even you ran `npm install` in a project already using this dependency in the specific window it was live, you will not normally install the malicious version. * There's quite a few tools to help mitigate the risk here, like https://socket.dev and npq (https://github.com/lirantal/npq). As one datapoint, look at the download stats for the affected Chalk package for example (https://www.npmjs.com/package/chalk?activeTab=versions) - the vast majority of installs were not installing the latest version anyway. There are caveats to this: e.g. you can use npm without a lockfile, in which case a fresh local install can pull down unexpected versions, or you could be manually updating/adding a different package which happens to depend on an affected package (which might…

you are not alone... https://socket.dev/blog/curl-project-and-go-security-teams-reject-cvss… I believe there must be some "Murphy's law" or something with a name for that situation. When there is an established system and process there will be people geniunely using and it will work 100% for such people and bring value to all parties. And then there will be people "gaming the system" (for instance "security" "researchers" using CVE created by them as a personal or corporate KPI) and abusing other legitimate players. It is like patent trolls but better fortunately for us. Fortunately for all people of reason, the system itself gets patched. Maybe not in the best way possible but still. Two examples: - Openvex - this is my way as a project owner/developer/maintainer to declare that CVE-XXXX-YYYYY is false positive and why. - context-aware vulnerability scanning (or exploitability scanning) - govulncheck is a great example of that. You run and it says, module X has vulnerabilities Y and Z but you keep calm because we have not found any symbols in your codebase using it. I wish more scanners would adopt the second approach and projects like npm would greatly benefit from it. As you truly note you pick a random project and it will be 50% filled with ReDos or something that will be sitting in some nested dependency of eslint's dep tree that will never see the light of production environment's CPU. That being said, any vulnerability reporting and obtaining a CVE ID…

1. We are in beta right now! We have the data and analysis, and are working hard to make it easy to integrate project specific views into it. 2. https://socket.dev/roadmap See https://socket.dev/npm/issue for analysis we have developed on a per-package basis. We are working on integrating these with our GitHub App to provide custom tailored project views into this data. More info here https://socket.dev/blog/inside-node-modules 3. It will be a paid product, but is free while it is in beta. We plan on keeping it free for open source. We are looking into providing support for the Deno ecosystem down the road as well. The capabilities stuff they have is super great, but you lose all of that benefit for every dependency as soon as you turn it off, so we think there is probably room for this kind of analysis there. Hopefully Socket can provide a similar signal that --allow-net provides, but for all of npm!

Confirmed: https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-…

They didn't back up their meme with real commentary because they have no real commentary to stand on: They're spreading cheap disdain & scorn for npm. But most other package management systems have similar abilities to run pretty un-sandboxed code. TrapDoor has hit python, rust, and js repos. https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates

PyPI, May 11. [1] Crates.io, May 22 [2] Composer, May 22 [3] [1] https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-question… [2] https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates [3] https://phoenix.security/laravel-lang-composer-supply-chain-compromise…

I think I checked a few weeks ago and whatwedo.twig was not on OpenVSX at that time, so I'm suspecting it is a case of name-squatting. This seems to be confirmed here: https://socket.dev/openvsx/package/whatwedo.twig/versions/1.2.8?platfo…

> Says Only Development Community Where This Regularly Happens We've had such issues on other places as well... Shai-Hulud got into Maven [1] and PHP Composer [2], typosquatters got into Maven [3], and it's not new either [4]. No one is safe from skiddies, much less from nation state actors. [1] https://thehackernews.com/2025/11/shai-hulud-v2-campaign-spreads-from-… [2] https://semgrep.dev/blog/2026/malicious-intercom-php-package-spreads-m… [3] https://www.esecurityplanet.com/threats/malicious-jackson-lookalike-li… [4] https://socket.dev/blog/malicious-maven-package-exfiltrates-oauth-cred…

NPM seems to have introduced the flag `minimumReleaseAge` for this exact purpose. However even though are many recent references to it[0][1][2] I don't see it anywhere in the NPM documentation. [0] https://news.ycombinator.com/item?id=47513932 [1] https://github.com/npm/cli/issues/8570 [2] https://socket.dev/blog/npm-introduces-minimumreleaseage-and-bulk-oidc…

Just sharing for awareness, NPM does support that as of February: https://socket.dev/blog/npm-introduces-minimumreleaseage-and-bulk-oidc… It must have been a very quiet announcement because I just found out about it this week.