Spearphishing Campaign Abuses npm Registry to Target U.S. and Allied Manufacturing and Healthcare Organizations

A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting sales personnel at critical infrastructure organizations.

Dec 23, 2025 Malware, npm

Malicious NuGet Package Typosquats Popular .NET Tracing Library to Steal Wallet Passwords

Impostor NuGet package Tracer.Fody.NLog typosquats Tracer.Fody and its author, using homoglyph tricks, and exfiltrates Stratis wallet JSON/passwords to a Russian IP address.

Dec 15, 2025 Malware, NuGet

Malicious Go Packages Impersonate Google's UUID Library and Exfiltrate Data

A pair of typosquatted Go packages posing as Google's UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.

Dec 5, 2025 Go, Supply Chain

North Korea Contagious Interview npm attacks artwork

Inside the GitHub Infrastructure Powering North Korea's Contagious Interview npm Attacks

Socket Threat Research Team maps a rare inside look at OtterCookie's npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korea's Contagious Interview operation.

Nov 26, 2025 Malware, North Korea

Shai Hulud Strikes Again (v2)

Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.

Nov 24, 2025 Supply Chain, npm

Malicious Chrome extension exfiltrates seed phrases artwork

Malicious Chrome Extension Exfiltrates Seed Phrases, Enabling Wallet Takeover

A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.

Nov 12, 2025 Malware, Browser Extensions

Malicious NuGet packages typosquatting Nethereum artwork

Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys

The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.

Oct 22, 2025 Malware, NuGet

131 spamware Chrome extensions targeting WhatsApp artwork

131 Spamware Extensions Targeting WhatsApp Flood Chrome Web Store

The Socket Threat Research Team uncovered a coordinated campaign that floods the Chrome Web Store with 131 rebranded clones of a WhatsApp Web automation extension to spam Brazilian users.

Oct 18, 2025 Threat Intelligence, Browser Extensions

North Korea Contagious Interview 338 malicious npm packages artwork

North Korea's Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.

Oct 10, 2025 Malware, North Korea

Two malicious Rust crates impersonate popular logger artwork

Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys

Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.

Sep 24, 2025 Malware, Rust