Socket
フィード
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
Socket
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
21時間前
Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign
Socket
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.
3日前
New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs
Socket
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.
3日前
White House Launches Gold Eagle Initiative to Manage Surge in AI-Discovered Vulnerabilities
Socket
The White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical software.
8日前
Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping
Socket
A Shai-Hulud infection exposed Suno's source code, which shows the AI music startup stream-ripped tracks to train its models.
9日前
Next.js moves to scheduled security releases
Socket
Vercel is formalizing a monthly release program for Next.js. The change follows React2Shell and a sharp rise in AI-assisted vulnerability discovery.
9日前
11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload
Socket
11 malicious NuGet tools pose as game cheats to deploy Windows payloads, track hosts, and use Google Sheets for telemetry and control.
11日前
Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader
Socket
4 compromised asyncapi packages deliver miasma botnet loader on macOS, Linux and Windows.
11日前
jscrambler npm Package Compromised in Supply Chain Attack
Socket
A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.
14日前
Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials
Socket
A malicious .NET package is typosquatting the Braintree SDK to steal live payment card data, merchant API keys, and host secrets from production apps.
16日前