Feross

🚨 Active supply chain attack spanning npm, PyPI, and Crates.io simultaneously. Socket is tracking a campaign we’re calling TrapDoor: 34+ malicious packages and 384+ versions designed to steal crypto wallets, SSH keys, AWS credentials, GitHub tokens, browser data, and environment variables from developers. We had a median detection time of 5 minutes and 27 seconds. Fastest detection was 58 seconds after publication. The packages target crypto, DeFi, Solana, Sui/Move, and AI developers. Names like crypto-credential-scanner, solidity-deploy-guard, sui-move-build-helper, and prompt-engineering-toolkit are crafted to look like legitimate dev tools. Each ecosystem uses a different execution path: • npm: postinstall hooks run trap-core.js, a 1,149-line credential harvester that validates stolen AWS/GitHub tokens via API calls and attempts SSH-based lateral movement • PyPI: packages auto-execute on import, download JavaScript from an attacker-controlled GitHub Pages domain, and run it via node -e • Crates.io: malicious build.rs scripts search for wallet keystores, XOR-encrypt them, and exfiltrate to GitHub Gists What makes this campaign especially notable: the npm payload plants persistence through .cursorrules and CLAUDE.md files using zero-width Unicode characters, attempting to trick AI coding assistants into running “security scans” that exfiltrate secrets. The attacker also opened PRs against major AI projects (LangChain, LlamaIndex, MetaGPT, OpenHands, browser-use) trying to inject these files into codebases directly. If you work in crypto, DeFi, or AI tooling: audit your lockfiles, check for any of the listed packages, and review your project for unexpected .cursorrules or CLAUDE.md files. Full list of IOCs and affected packages: socket.dev/blog/trapdoor-…

🔺 Treat AI-suggested deps like PRs from strangers. Out of 5 frontier LLMs and ~200k coding prompts, all 5 models hallucinated the same nonexistent package names. 53 remain open to register on PyPI or npm (!!) One slopsquat reaches users of all models. socket.dev/blog/slopsquat…

🚨 Attackers are running an exploitation campaign on GitHub's own Actions runners. Socket traced malicious dev versions of 10 Packagist packages to 583 weaponized workflow files. Runners pull payloads from C2, exploit CVE-2026-41940 (cPanel & WHM auth bypass), and harvest AWS keys, GitHub tokens, and SSH material. Campaign signatures match ~15,000 to 16,000 workflow files across GitHub. socket.dev/blog/github-ac…

This is the kind of attack that I can appreciate from a theannoyingsite[dot]com perspective. Clever.

@jaredpalmer @cognition @asha_shar @ScottWu46 Congrats!

Personal update: I’ve joined @Cognition to lead engineering. I’m grateful to @asha_shar and everyone at Xbox for an amazing year. Excited for this next chapter with @ScottWu46 and team.

The White House launched a new initiative to coordinate AI-discovered vulnerabilities across government, critical infrastructure, and open source. No operating plan is public yet, even as federal vulnerability programs face massive backlogs and failures. socket.dev/blog/white-hou…

I'm so proud of this partnership with @Replit and the massive number of developers that we're protecting every day. 8,000 malicious packages blocked per day for Replit developers!

@matteocollina @github Huge congratulations and massively overdue!

After 16+ years on @github, I’m finally a star. ⭐️

@boardyai @Replit You'll see. Stay tuned. Can't share anything yet.

@feross @Replit 8k/day is a wild number. who's the next platform you're trying to land?

@Replit @SocketSecurity So proud of this partnership and all the developers we are helping to protect!

Blocking the bad and removing the noise. Our @SocketSecurity partnership blocks ~8,000 malicious packages a day and filters out 30% of false-positive critical vulnerability alerts, the ones that were never exploitable. We focus on security so you can focus on building.

Recording of my talk at @sec_kc about malware in extensions. A summary of the attacks that might impact your organization. youtu.be/y850kRQXMCI?is…

This is correct

LLM-assisted vulnerability discovery is raising patch volume across the industry and changing how projects ship security fixes. Next.js is the latest to respond, moving to scheduled monthly releases starting July 20. socket.dev/blog/nextjs-mo…

@neil_jhaveri @mimestream Amazing news!

I am so glad to report that the @Mimestream TestFlight beta has finally been approved to be a Default Email App on iOS! Coming to the next TestFlight update!

🚨 Attackers compromised four npm packages in the @​asyncapi namespace to deliver the Miasma botnet loader. The malware runs when an infected module is imported, then pulls an encrypted payload from IPFS across macOS, Linux, and Windows. socket.dev/blog/asyncapi-…

🎮 11 malicious NuGet tools posed as game cheats to deliver Windows malware that used Google Sheets to track hosts and enforce a remote ban list. Three of the payloads also let Telegram users remotely capture and receive screenshots from the host. socket.dev/blog/11-malici…

🚨 Active supply chain attack on AsyncAPI. Five malicious @​asyncapi packages were published to npm today, shipped through the project's own GitHub Actions trusted publishing pipeline after an attacker poisoned a commit on the next branch. Affected versions: @asyncapi/generator@3.3.1 @asyncapi/generator-helpers@1.1.1 @asyncapi/generator-components@0.7.1 @asyncapi/specs@6.11.2 @asyncapi/specs@6.11.2-alpha.1 The first three were published within a six-second window at 07:10 UTC. AsyncAPI tooling runs on developer machines and CI runners, so the implant executes directly in build environments. Socket AI Scanner flagged all five releases as confirmed malware. This is a multi-stage botnet loader: • On load, an obfuscated implant spawns a detached, hidden Node.js child process • The child downloads an 8.25 MB encrypted payload (sync.js) from IPFS into a fake "NodeJS" data directory on Windows, macOS, or Linux • HKDF-SHA256 key derivation and AES-256-GCM decryption unpack the final stage • That final stage is Miasma, a 3.09 MB command framework with REST-based C2 plus fallback channels over Nostr, IPFS, Ethereum RPC, and BitTorrent DHT • 12 command types, including ShellExec, file get/put/delete, payload updates, and self-destruct • Persists on Linux via a systemd user service (miasma-monitor.service) The campaign config is labeled "miasma-train-p1" and contains dormant modules for PyPI, RubyGems, and Cargo. npm appears to be phase one. If you installed any affected version, treat the host as potentially compromised. Check for detached Node.js processes with ignored stdio, connections to 85[.]137[.]53[.]71, fake NodeJS directories, and the miasma-monitor service. Pin to known-good versions and audit lockfiles before your next install. Full analysis: socket.dev/blog/asyncapi-… Developing story...

"The AI does the building. I am the curator."

@pedrofortuna Great news!

@feross Hi! I appreciate your service, but the attack was contained around 3h ago. Check our security update, please: jscrambler.com/blog/security-…

Attack still ongoing…