Malicious Ruby Gems Exfiltrate Telegram Tokens and Messages Following Vietnam Ban

Malicious Ruby gems typosquat Fastlane plugins to steal Telegram bot tokens, messages, and files, exploiting demand after Vietnam's Telegram ban.

Jun 3, 2025 Malware, RubyGems

Monkey-Patched PyPI Packages Use Transitive Dependencies to Steal Solana Private Keys

Malicious PyPI package semantic-types steals Solana private keys via transitive dependency installs using monkey patching and blockchain exfiltration.

May 29, 2025 Malware, PyPI

60 Malicious npm Packages Leak Network and Host Data in Active Malware Campaign

Socket's Threat Research Team has uncovered 60 npm packages using post-install scripts to silently exfiltrate hostnames, IP addresses, DNS servers, and user directories to a Discord webhook.

May 23, 2025 Malware, npm

Malicious Koishi Chatbot Plugin Exfiltrates Messages Triggered by 8-Character Hex Strings

Malicious Koishi plugin silently exfiltrates messages with hex strings to a hardcoded QQ account, exposing secrets in chatbots across platforms.

May 19, 2025 Malware, npm

The Landscape of Malicious Open Source Packages: 2025 Mid‑Year Threat Report

A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.

May 14, 2025 Threat Reports

Backdooring the IDE: Malicious npm Packages Hijack Cursor Editor on macOS

Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.

May 7, 2025 Malware, npm

The Bad Seeds: Malicious npm and PyPI Packages Pose as Developer Tools to Steal Wallet Credentials

Socket researchers uncovered malicious npm and PyPI packages that steal crypto wallet credentials using Google Analytics and Telegram for exfiltration.

Apr 22, 2025 Malware, PyPI

Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads

Lazarus-linked threat actors expand their npm malware campaign with new RAT loaders, hex obfuscation, and over 5,600 downloads across 11 packages.

Apr 4, 2025 Malware, North Korea

Black Basta's Dependency Confusion Ambitions and Ransomware in Open Source Ecosystems

Research uncovers Black Basta's plans to exploit package registries for ransomware delivery alongside evidence of similar attacks already targeting open source ecosystems.

Mar 19, 2025 Malware, npm

Lazarus Strikes npm Again with New Wave of Malicious Packages

The Socket Research Team has discovered six new malicious npm packages linked to North Korea's Lazarus Group, designed to steal credentials and deploy backdoors.

Mar 10, 2025 Malware, North Korea