Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.

pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.

Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.

vlt adds real-time security selectors powered by Socket, enabling developers to query and analyze package risks directly in their dependency graph.

CISA extended MITRE’s CVE contract by 11 months, avoiding a shutdown but leaving long-term governance and coordination issues unresolved.

Socket's Rubygems ecosystem support is moving from beta to GA, featuring enhanced security scanning to detect supply chain threats beyond traditional CVEs in your Ruby dependencies.

The Socket Research Team investigates a malicious npm package that appears to be an Advcash integration but triggers a reverse shell during payment success, targeting servers handling transactions.

The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.

At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.

We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.