Feross

🚨 Active supply chain attack on AsyncAPI. Five malicious @​asyncapi packages were published to npm today, shipped through the project's own GitHub Actions trusted publishing pipeline after an attacker poisoned a commit on the next branch.

Affected versions:

@asyncapi/generator@3.3.1
@asyncapi/generator-helpers@1.1.1
@asyncapi/generator-components@0.7.1
@asyncapi/specs@6.11.2
@asyncapi/specs@6.11.2-alpha.1

The first three were published within a six-second window at 07:10 UTC. AsyncAPI tooling runs on developer machines and CI runners, so the implant executes directly in build environments.

Socket AI Scanner flagged all five releases as confirmed malware. This is a multi-stage botnet loader:

• On load, an obfuscated implant spawns a detached, hidden Node.js child process
• The child downloads an 8.25 MB encrypted payload (sync.js) from IPFS into a fake "NodeJS" data directory on Windows, macOS, or Linux
• HKDF-SHA256 key derivation and AES-256-GCM decryption unpack the final stage
• That final stage is Miasma, a 3.09 MB command framework with REST-based C2 plus fallback channels over Nostr, IPFS, Ethereum RPC, and BitTorrent DHT
• 12 command types, including ShellExec, file get/put/delete, payload updates, and self-destruct
• Persists on Linux via a systemd user service (miasma-monitor.service)

The campaign config is labeled "miasma-train-p1" and contains dormant modules for PyPI, RubyGems, and Cargo. npm appears to be phase one.

If you installed any affected version, treat the host as potentially compromised. Check for detached Node.js processes with ignored stdio, connections to 85[.]137[.]53[.]71, fake NodeJS directories, and the miasma-monitor service. Pin to known-good versions and audit lockfiles before your next install.

Full analysis: https://socket.dev/blog/asyncapi-supply-chain-attack

Developing story...

Today is a big day for Socket. We just raised a $60M Series C at a $1B valuation, led by Thrive Capital with participation from Andreessen Horowitz, Abstract, and Capital One Ventures. Total funding is now $125M.

Four years ago, we started Socket because open source dependencies were flowing into production faster than anyone could vet them. AI has massively accelerated that. Code is being written, shipped, and deployed before any human reads it. Security has to operate at that same speed.

One data point from Thrive's diligence that I keep coming back to: they first discovered Socket because Cursor, OpenAI, and Anthropic all independently told them it was the most important security tool they'd adopted for AI-driven development. Three of the most sophisticated AI companies converging on the same vendor unprompted.

Since our Series B, Socket has grown to more than 20,000 organizations, protecting over 1.5 million repositories and blocking more than 1,000 supply chain attacks every week. The team is now over 100 people.

Three out of five FAANG companies are Socket customers. So are the companies building the most ambitious AI products: Anthropic, Cursor, xAI, Figma, Vercel, Replit, Scale AI, Gusto, Mercado Libre, and Cribl, alongside Fortune 100s in financial services and global media.

What we've shipped since the last round:

• Socket Firewall blocks malicious packages at install time, before they reach a developer's laptop or CI pipeline. Free for everyone.

• Reachability analysis via our acquisition of Coana, eliminating 50-80% of irrelevant vulnerability alerts by focusing only on CVEs that are actually exploitable.

• Socket Certified Patches for remediating exploitable CVEs in seconds without waiting on upstream maintainers.

• Coverage extending to browser extensions, editor extensions, MCP servers, and AI tools via our acquisition of Annex Security.

When the Axios compromise hit, our detection systems flagged the malicious dependency within six minutes. Within 24 hours, more than 2,000 organizations onboarded to Socket to block it.

Where the funding goes: deeper investment in Firewall, massively expanding Certified Patches, moving protection closer to every point of install across the developer toolchain, and new product launches pushing Socket into a category we haven't entered before.

We're hiring across engineering, sales, customer success, and threat intel.

❤️ Thank you to our customers, investors, and the open-source community for your support. Together, we’re making software safer for everyone.

🚨 node-ipc is compromised again.

Three new malicious versions just dropped: 9.1.6, 9.2.3, and 12.0.1. Socket’s AI scanner flagged them as malware within three minutes of publication.

The attack vector: a dormant maintainer account (atiertant) was likely taken over via an expired email domain. The attacker registered the lapsed domain, triggered an npm password reset, and gained publish rights to a package with millions of historical downloads.

The payload is a credential stealer embedded in the CommonJS entrypoint (node-ipc.cjs). It activates on require(“node-ipc”), not through a postinstall script. Here’s what it does:

• Fingerprints the host (OS, arch, hostname, uname)
• Harvests 113-127 credential file patterns depending on platform (AWS, GCP, Azure, SSH keys, Kubernetes configs, npm tokens, .env files, shell histories, macOS Keychain databases, and more)
• Dumps the entire process.env, capturing every CI secret and cloud credential in memory
• Builds a gzip archive in a temp directory
• Exfiltrates everything over DNS TXT queries to bt[.]node[.]js, using a bootstrap resolver at sh[.]azurestaticprovider[.]net:443 (a deliberate lookalike of Microsoft’s Azure Static Web Apps domain)

The DNS exfiltration is chunked. A 500 KB archive generates roughly 29,400 TXT queries. The body is XOR-encrypted with a SHA-256 keystream, base64-encoded, alphabet-substituted, and split into 31-character chunks before hex-encoding into DNS labels. Header, data, and footer queries use xh, xd, and xf prefixes respectively.

The malware forks a detached child process (env var __ntw=1) so credential theft runs silently in the background. It also exposes a __ntRun export, meaning any downstream code that calls require(“node-ipc”).__ntRun() can trigger a second collection/exfiltration cycle.

ESM-only consumers using the import path are not affected by the reviewed package metadata. CommonJS consumers are.

This is the same package involved in the 2022 protestware incident. It has a history.

If you use node-ipc:

• Do not install 9.1.6, 9.2.3, or 12.0.1
• Audit your lockfiles for these versions
• If you loaded the CommonJS entrypoint, treat all environment variables, SSH keys, cloud credentials, npm tokens, and local secrets as compromised. Rotate immediately.
• Hunt for DNS TXT queries to bt[.]node[.]js and sh[.]azurestaticprovider[.]net in your network logs
• Check for temp files matching /nt-/.tar.gz

Credit to Ian Ahl (@TekDefense) for first publicly identifying the expired-domain account takeover vector.

Developing story. Full technical breakdown and IOCs on the Socket blog: https://socket.dev/blog/node-ipc-package-compromised

🎉 Socket is proud to be named to the Rising in Cyber 2026 list by Notable Capital, recognizing 30 private cybersecurity startups selected by nearly 150 practicing CISOs and cybersecurity executives.

https://socket.dev/blog/rising-in-cyber-2026

🚨 Active supply chain attack on TanStack. 84 npm packages in the @​tanstack namespace have been compromised with a credential-stealing worm.

@​tanstack/react-router alone has 12M+ weekly downloads. The affected packages span react-router, solid-router, vue-router, start, and dozens more across the TanStack ecosystem. Additional compromised packages were also found in the @​uipath namespace and several other organizations.

Socket flagged every malicious version within six minutes of publication.

Here's what the malware does:

• Injects a 2.3 MB obfuscated file (router_init.js) that daemonizes itself on install, detaching from the terminal so nothing looks wrong

• Harvests credentials from GitHub Actions (including OIDC tokens), AWS (IMDSv2, Secrets Manager, SSM across multiple regions), HashiCorp Vault, and Kubernetes service accounts

• Uses stolen OIDC tokens to autonomously republish itself to npm under the compromised maintainer's identity, turning every infected CI pipeline into a new propagation vector

• Writes persistence hooks into .claude/ and .vscode/ directories so it survives across reboots and re-executes when developers use Claude Code or open VS Code

• Exfiltrates everything through the Session decentralized P2P network, making C2 traffic nearly indistinguishable from encrypted messaging

• Commits copies of itself to maintainer repositories via GitHub's GraphQL API, spoofing the author as claude@users.noreply.github.com to blend in with legitimate Claude Code activity

• Generates valid Sigstore provenance attestations for the malicious packages, meaning provenance badges alone cannot be trusted as a security signal

The attack vector: an orphaned commit (no parent history) in the TanStack/router repo was used to hijack the CI workflow's OIDC token, bypassing existing publishing protections including 2FA. The commit was authored by the account "voicproducoes," whose repos include projects named "A Mini Shai-Hulud has Appeared," linking this to an ongoing campaign Socket has been tracking.

TanStack maintainer Tanner Linsley confirmed the attack and the team is unpublishing compromised versions and shutting down publishing pipelines while they remediate.

What to do right now:

• Check your dependency tree for router_init.js. SHA256: ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c

• Rotate npm tokens, GitHub PATs, AWS credentials, Vault tokens, and K8s service account tokens on any system that installed an affected version

• Audit .claude/ and .vscode/ directories for router_runtime.js, setup.mjs, or unfamiliar hooks

• Check git log for commits authored by claude@users.noreply.github.com that weren't initiated through the legitimate Claude Code app

• Block egress to filev2.getsession[.]org at the DNS level

• Do not trust Sigstore provenance badges alone

Full list of affected packages and IOCs: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack

Developing story...

RE: @getajobmike@ruby.social

We need massive investment in open-source infrastructure, funding for maintainers, education across the board, and widespread deployment of tools like @SocketSecurity@fosstodon.org to raise the bar for attackers and make this kind of thing a lot harder.

🚨 Active supply chain attacks on both PyPI and npm today. lightning 2.6.2/2.6.3 and intercom-client 7.0.4 are compromised with credential-stealing malware. Same attacker, same tooling, two ecosystems. Downgrade immediately.

• Lightning: https://socket.dev/blog/lightning-pypi-package-compromised

• Intercom: https://socket.dev/blog/intercom-s-npm-package-compromised-in-supply-chain-attack

🚨 A brand-squatting npm package impersonating TanStack shipped malicious versions that exfiltrate environment variables from developers’ machines during install.

We spoke to Tanner Linsley, creator of TanStack, who confirmed that the maintainer of the unscoped tanstack package is not associated with TanStack or the official @​tanstack/* projects in any way. The package is unrelated to the project's official CLI, and represents an ongoing brandjacking issue.

He also said TanStack has filed legal documents related to a pending trademark infringement claim against the maintainer, that the maintainer previously demanded $10,000 from him, and that TanStack has repeatedly tried, unsuccessfully, to get npm to address the situation.

https://socket.dev/blog/tanstack-brandsquat-compromise

🚨 Active supply chain attack hitting SAP’s CAP ecosystem on npm.

Four packages tied to SAP’s Cloud Application Programming Model just shipped versions with a new preinstall script that downloads and executes a platform-specific binary. These packages never required this before today.

Affected versions:

• mbt@1.2.48
• @cap-js/db-service@2.10.1
• @cap-js/postgres@2.2.2
• @cap-js/sqlite@2.2.2

Combined, these packages see 570K+ weekly downloads. @cap-js/db-service and @cap-js/sqlite alone account for ~510K of that. If you’re building on SAP BTP or using MTA deployment pipelines, check your lockfiles now.

The compromised versions added a preinstall script that acts as a bootstrapper: it downloads a Bun ZIP from GitHub Releases, extracts it, and immediately executes the binary. It follows HTTP redirects without validating the destination. On Windows, it invokes PowerShell with -ExecutionPolicy Bypass.

All four versions were published within a ~2.5 hour window this morning (April 29, UTC). At least one version (@cap-js/sqlite@2.2.2) has already been unpublished.

Socket flagged the malicious behavior and is continuing to investigate. If you’re affected:

• Do not install the affected versions
• Pin to previous known-good versions
• Rotate any credentials or tokens exposed in build/dev environments
• Review CI/CD logs for unexpected network calls or binary execution

Developing story…

https://socket.dev/blog/sap-cap-npm-packages-supply-chain-attack

Excited to share that @SocketSecurity@fosstodon.org just acquired @secureannex@bird.makeup, the extension security company built by @tuckner@infosec.exchange. John is joining Socket.

John built Secure Annex as a solo founder into a product that security teams at Reddit, Brave, Torq, and Movable Ink depend on. His research on compromised browser extensions has been some of the sharpest work in the space. We're lucky to have him.

This is our second acquisition in 12 months, after Coana (reachability analysis) last year.

Why now? The software supply chain isn't just package managers anymore. In the past week alone, Socket published findings on compromises hitting npm packages, Docker images, VS Code releases, GitHub Actions, and Open VSX sleeper extensions. Attackers are moving across packages, extensions, containers, CI/CD, and AI tooling in rapid succession. The boundaries between these ecosystems are collapsing.

Socket is moving protection closer to the point of install, wherever software enters an organization. Socket Firewall already blocks malicious packages before they reach a developer's environment. We're extending that same model to browser extensions, code editor extensions, MCP servers, and AI tools.

To Secure Annex customers: pricing stays the same, features keep working, no gap in coverage. We'll keep you updated as we integrate.

https://socket.dev/blog/socket-acquires-secure-annex

🚨 Bitwarden CLI compromised in active supply chain attack.

@bitwarden/cli version 2026.4.0 contains malicious code in bw1.js, published after attackers compromised a GitHub Action in Bitwarden's CI/CD pipeline.

This is part of the broader Checkmarx supply chain campaign that has been hitting multiple repositories through the same GitHub Actions vector. Bitwarden is the latest confirmed target.

Socket's research team discovered the compromise. We're conducting a full technical analysis now and will publish IOCs, affected version details, and remediation guidance.

If you use Bitwarden CLI:

• Review your CI logs for unexpected behavior in recent builds
• Rotate any secrets that may have been exposed to the compromised workflow
• Pin to a known-good version until this is resolved

Developing story...

See how the attack worked →

https://socket.dev/blog/bitwarden-cli-compromised

🚨 DEVELOPING STORY: Malicious artifacts found in the official @checkmarx@bird.makeup KICS Docker Hub repository and VS Code extensions.

@Docker@cloud-native.social flagged suspicious activity on the checkmarx/kics Docker Hub repo and alerted Socket. Our investigation found that attackers overwrote existing image tags (including v2.1.20 and alpine) and pushed a fake v2.1.21 tag with no corresponding upstream release.

The poisoned KICS binary was modified to collect and exfiltrate data. It could generate an uncensored scan report, encrypt it, and send it to an external endpoint. If you use KICS to scan Terraform, CloudFormation, or Kubernetes configs, that means credentials and secrets in those files were potentially exfiltrated.

This goes beyond DockerHub. We also found suspicious VS Code extension releases for Checkmarx tooling:

• Versions 1.17.0 and 1.19.0 introduced code that downloads and executes a remote addon via the Bun runtime
• The behavior was removed in 1.18.0, then reappeared in 1.19.0
• Relies on a hardcoded GitHub URL to fetch and run JavaScript with no user confirmation or integrity verification

This looks like a broader supply chain compromise affecting multiple Checkmarx distribution channels.

Credit to Docker for catching the suspicious image push and notifying us. Their monitoring enabled rapid investigation.

If your org used the affected KICS image, treat any secrets or credentials exposed to those scans as potentially compromised. Rotate them now.

Developing story... We've disclosed to the Checkmarx team and will publish full technical analysis as the investigation continues.

Socket's first appearance on TBPN. We talked about what's been an intense week in supply chain security and why AI is accelerating the problem.

AI coding agents install dependencies at machine speed with zero human review. Every 'npm install' is a trust decision. And right now, nobody's checking anything.

The Axios package had 100M+ weekly downloads. North Korean state actors social-engineered a single maintainer and compromised it. We caught it in under 6 minutes.

The better AI gets at writing code, the faster the dependency graph grows, and the more attack surface exists in the software supply chain.

We've been building for exactly this moment.

@SocketSecurity@fosstodon.org

We're at @rsaconference@bird.makeup this week! Come by and say hi!

Supply chain attacks are accelerating, AI coding tools are creating new attack surfaces, and we've been busy building. Come see what we've been working on.

📍 Two ways to find us:

• The Metreon (161 4th St, steps from Moscone West) -- we have a private suite Mon–Thu, 8am–5pm. Book time with me here: https://socket.dev/book/rsa

• Booth S-2434, Moscone South -- stop by for a live demo on the show floor.

🚨 Breaking: Trivy Docker images are compromised.

Tags 0.69.4, 0.69.5, and 0.69.6 contain infostealer IOCs. The latest images were pushed to Docker Hub without corresponding GitHub releases. `latest` currently points to a malicious image.

Details: https://socket.dev/blog/trivy-docker-images-compromised

It's @SocketSecurity@fosstodon.org's first year on the RSA show floor 🎉

Booth S-2434, Moscone South (March 23-26). Come see a demo and talk about what's actually happening in supply chain security right now. AI coding tools are becoming a new attack vector and attacks are accelerating.

Book 1:1 time with me: https://socket.dev/book/rsa

Also kicking off the week with a rooftop happy hour Sunday 3/22 alongside RunReveal, Cside, Keycard + Tracebit 🍹 RSVP: https://luma.com/s9qdxmxm

You don’t see this every day: attackers hiding C2 infrastructure inside computer science essays on Pastebin using character-level steganography, then wiring it into 26 typosquatted npm packages impersonating some of the ecosystem’s most widely-used libraries.

Socket detected the cluster within minutes of publication, uncovering a disciplined, multi-stage operation linked to the Contagious Interview campaign that delivers a full infostealer and RAT stack built to harvest developer credentials.

https://socket.dev/blog/stegabin-26-malicious-npm-packages-use-pastebin-steganography

💥 Your AI coding assistant might be stealing your SSH keys. 💥

@SocketSecurity@fosstodon.org found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.

RE: @SocketSecurity@fosstodon.org

🚨 Active Shai-Hulud–Like npm Supply Chain Attack: SANDWORM_MODE

Socket’s Threat Research Team has identified an active Shai-Hulud–like worm campaign spreading across 19+ malicious npm packages published under two aliases.

The campaign is designed to steal credentials from developer workstations and CI environments, inject malicious GitHub Actions workflows for self-propagation, poison AI toolchains via rogue MCP servers, and exfiltrate LLM API keys.

If you are a Socket customer, these packages are automatically blocked in the environments where Socket is deployed (and have been blocked since our initial confirmation ~36 hours ago).

We have notified npm, GitHub, and Cloudflare and are actively working to help dismantle the campaign.

If you think your organization may have been affected or would like help assessing your exposure, please reach out and we will help.

Full technical analysis: https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning

BIG NEWS: @SocketSecurity@fosstodon.org is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with 60,000+ skills.

https://socket.dev/blog/socket-brings-supply-chain-security-to-skills

Shipping PHP? Don't install malicious code!

Strongly recommend this post on npm’s staged publishing change after supply-chain turmoil. npm will roll out staged publishing to add a review step before releases go live after the Shai-Hulud attacks, giving maintainers a chance to catch bad releases.

Read it here: https://socket.dev/blog/npm-to-implement-staged-publishing

Must-read from Nicholas C. Zakas (ESLint maintainer) on how GitHub could better secure npm and prevent supply-chain attacks. https://humanwhocodes.com/blog/2026/01/how-github-could-secure-npm/