Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise

Socket found a malicious Intercom PHP package on Packagist using Composer plugin execution to steal credentials and spread across ecosystems.

Apr 30, 2026 Malware, Supply Chain

GlassWorm Open VSX sleeper extensions campaign artwork

73 Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations

Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.

Apr 24, 2026 Malware, Browser Extensions

Malicious Checkmarx Artifacts Found in Official KICS Docker Repository and Code Extensions

Docker and Socket have uncovered malicious Checkmarx KICS images and suspicious code extension releases in a broader supply chain compromise.

Apr 22, 2026 Supply Chain, Threat Intelligence

Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware

Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Apr 21, 2026 Supply Chain, npm

North Korea's Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.

Apr 7, 2026 North Korea

CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages

The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Mar 20, 2026 Supply Chain

GlassWorm transitive dependency campaign artwork

72 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies

Since January 31, 2026, we identified at least 72 additional malicious Open VSX extensions, including transitive GlassWorm loader extensions targeting developers through extensionPack and extensionDependencies manifest abuse.

Mar 13, 2026 Malware, Browser Extensions

5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files

Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Mar 10, 2026 Malware, Rust

Fake imToken Chrome extension phishing artwork

Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects

Mixed-script homoglyphs and a lookalike domain mimic imToken's import flow to capture mnemonics and private keys.

Mar 5, 2026 Malware, Browser Extensions

Malicious Go "crypto" Module Steals Passwords and Deploys Rekoobe Backdoor

An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.

Feb 26, 2026 Malware, Supply Chain