Typosquatted Go Packages Deliver Malware Loader Targeting Linux and macOS Systems

Malicious Go packages are impersonating popular libraries to install hidden loader malware on Linux and macOS, targeting developers with obfuscated payloads.

Mar 4, 2025 Malware, Go

Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy

Socket researchers uncovered a malicious PyPI package exploiting Deezer's API to enable coordinated music piracy through API abuse and C2 server control.

Feb 25, 2025 Malware, PyPI

Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for Persistence

Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.

Feb 4, 2025 Malware, Go

North Korean APT Lazarus Targets Developers with Malicious npm Package

Malicious npm package postcss-optimizer delivers BeaverTail malware, targeting developer systems; similarities to past campaigns suggest a North Korean connection.

Jan 29, 2025 Malware, North Korea

Gmail For Exfiltration: Malicious npm Packages Target Solana Private Keys and Drain Victims' Wallets

Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.

Jan 8, 2025 Malware, npm

Weaponizing OAST: How Malicious Packages Exploit npm, PyPI, and RubyGems for Data Exfiltration and Recon

Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.

Jan 3, 2025 Malware, Threat Reports

Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts

Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.

Dec 20, 2024 Malware, npm

Skuld Infostealer Returns to npm with Fake Windows Utilities and Malicious Solara Development Packages

Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.

Dec 18, 2024 Malware, npm

Malicious Maven Package Impersonating 'XZ for Java' Library Introduces Backdoor Allowing Remote Code Execution

Socket researchers found a malicious Maven package impersonating the legitimate 'XZ for Java' library, introducing a backdoor for remote code execution.

Dec 6, 2024 Malware, Supply Chain

Typosquatting Cryptographic Libraries: Malicious npm Packages Threaten Crypto Developers with Keylogging and Wallet Theft

Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.

Nov 27, 2024 npm