The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Popular npm packages keyv and cacheable compromised.

A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.

Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.

Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.