A self-propagating malware strain called Sandworm_Mode is targeting AI coding assistants and software development environments, stealing credentials, API keys, and secrets across the AI toolchain, acc…
A new defensive technique called a 'context bomb' — a short string hidden in decoy resources that triggers safety guardrails in offensive AI agents — reduced autonomous cyberattack success by roughly …
The official jscrambler npm package published five compromised versions on July 11, 2026, using a preinstall hook to drop a Rust infostealer that targets AI developer tool configurations, cloud creden…
A malicious version of the npm package jscrambler used a preinstall hook to deploy a Rust infostealer on developer machines. The attack targeted browser credentials, crypto wallets, and Bitwarden vaul…
Socket's AI scanner flagged a malicious NuGet package named Braintree.Net on July 3, 2026, which impersonates the official Braintree SDK to steal credit card data, merchant API keys, and host secrets.…
Socket's AI scanner detected 17 malicious npm and PyPI packages published on July 7, 2026, that typosquat popular payment apps PaySafe, Skrill, and Neteller to steal credentials and tokens from SDK de…
Socket CEO Feross Aboukhadijeh told the Risky Business podcast that AI coding agents are accelerating software supply chain risks by pulling in dependencies at machine speed and making unreviewed trus…
Socket Threat Research tracked a fresh compromise in the Miasma Mini Shai-Hulud supply chain campaign affecting legitimate npm packages under the @immobiliarelabs scope, including Backstage plugins fo…
Malware authors are subverting AI detection systems with code that commands LLM-assisted products to abort analysis. SentinelLabs discovered macOS.Gaslight, a Rust backdoor targeting MacOS systems, wh…
AI-generated code is flooding GitHub and degrading codebases, with research showing AI-written code has 1.7 times more critical issues and 45% ships with OWASP Top 10 vulnerabilities. Major projects l…
A new supply chain attack wave from the Mini Shai-Hulud, Miasma, and Hades malware family has compromised LeoPlatform and RStreams npm packages, GitHub Actions workflows, and the Verana Blockchain Go …
GitHub has 630 million repositories, with nearly half of all new code written by AI, but developer trust in AI code dropped from 77% to 60%. Carnegie Mellon University found 6 million fake stars, and …
A security expert warns that AI agents are creating a new software supply chain risk by fetching and running unvetted open-source packages in ephemeral sandboxes, bypassing traditional scanners and re…
Socket MCP has expanded its AI assistant capabilities to include organization alert review, threat feed investigation, and package file inspection, enabling AppSec and engineering teams to triage supp…
In June 2026, attackers hijacked the npm contributor account 'ehindero' to mass-publish malicious versions of 144 packages under the @mastra namespace, in what security researchers from JFrog, SafeDep…
Socket Threat Research identified shai_hulululud@1.0.48596, an npm package designed to probe AI-based malware scanners using prompt injection, token flooding, and obfuscated JavaScript. The package co…
Socket's Threat Research team identified 23 new malicious PyPI packages in the Mini Shai-Hulud, Miasma, and Hades supply chain attacks, expanding the campaign to 471 artifacts across npm and PyPI. The…
Socket appointed Andrew Becherer as its first Chief Information Security Officer. Becherer, former CISO at Datadog and Iterable, will lead security, compliance, and risk as the company protects over 2…
Socket has partnered with Replit to integrate its Socket Firewall into Replit's AI-powered development platform, blocking approximately 8,000 malicious open source packages per day. The partnership ai…
Socket Threat Research identified 23 new malicious PyPI packages in the Mini Shai-Hulud, Miasma, and Hades supply chain attacks, targeting bioinformatics and AI/MCP developers with trojanized native e…