Socket links a cluster of VS Code themes across Visual Studio Marketplace and Open VSX to two confirmed malicious extensions, including one assessed as GlassWorm with high confidence. Reported Marketplace extensions were removed.
Socket says a Firefox extension posing as a PDF identity verifier downloads its malicious configuration after installation, then targets Google sessions and credentials. The campaign has targeted Portuguese- and Spanish-speaking users since September 11, 2026.
Four compromised MemTensor package releases bundle cross-platform Go payloads that launch on plugin startup, memory recall, or Python import. Static analysis shows they search developer homes and environments for secrets and communicate with C2 servers under skyleen[.]ф
Socket researchers found PolinRider malware in development versions of a Packagist package and describe how the campaign compromises Git repositories, infects developer environments, and delivers infostealers.
Socket found a Twitch extension forwarding OAuth session tokens for about 31,000 Chrome and Firefox users to JeetBot proxies. Fixed versions are now available; users should revoke existing Twitch sessions.
Socket traced malicious browser extensions targeting Axiom Trade and Padre users. The extensions harvest authenticated session and wallet-related data and send it to attacker-controlled infrastructure.
Socket found 13 trojanized Composer themes that inject gambling redirects and, on vulnerable iPhones, a WebKit-to-kernel exploit chain delivering spyware that steals device data and cryptocurrency wallet seeds.
Ten malicious versions of @7nohe/openapi-react-query-codegen were published through an abused GitHub Actions workflow. The package’s install-time payload steals credentials and can propagate through developer and CI environments.
Socket analyzed 19 malicious Chrome and Edge extensions linked to the Superior campaign. Their C2-controlled malware can steal wallet secrets, credentials, session data and browsing history; one Edge extension was still active when reported.
A supply-chain attack compromised three Rust crates, adding a typosquatted dependency that ran malware during Cargo builds. The backdoor targeted Linux, macOS and Windows; Rust removed the releases, and affected build hosts should be treated as compromised.
Socket traced 77 linked Firefox extensions to a campaign involving wallet-secret theft, credential and clipboard collection, and deceptive sports-score shells. The research confirmed malicious payloads in 40 extensions; Mozilla removed one reported extension.
Socket reports that 520 of 522 analyzed extensions routed browser traffic through shared SOCKS5 proxies. The campaign included 274 extensions impersonating 66 brands, and the investigation documented evasion, subscription fraud, and post-review code changes.
A malicious npm preinstall hook in Keyv, Cacheable, and other packages steals developer and CI credentials, spreads by republishing trojanized packages, and installs persistence. The investigation remains ongoing.
Researchers uncovered a targeted campaign that spreads malicious functionality across npm packages impersonating Alibaba’s private packages. The chain delivers a cross-platform RAT with data theft, command execution, persistence, and lateral-movement capabilities.
Socket researchers found import-time malware in two Joyfill npm beta releases. The implant retrieves payloads through blockchain transactions and can deliver a remote-access trojan; separate captured payloads include a credential-stealing Python program.
A fake Corepack site targets developers with downloads that install an infostealer and proxyware, while a separate path delivers adware-style software. Node.js contributors warned users, and OpenJS says the ISP was given 24 hours to address the abuse.
Socket Dev Research found a broad campaign using malicious GitHub Actions workflows in compromised repositories to scan for and exploit cPanel/WHM CVE-2026-41940, then steal credentials. Affected Packagist versions reflected repository compromise; installing them alone,
Socket researchers found compromised AsyncAPI npm releases that run an obfuscated loader when imported, fetch Miasma from IPFS, and can enable remote tasking and persistence. The poisoned source commit was published through GitHub Actions.
Five compromised Jscrambler npm releases delivered a cross-platform infostealer targeting developer credentials and secrets. Jscrambler confirmed unauthorized publication; version 8.22.0 is reported clean, and affected environments should be audited.
Socket researchers found malicious NuGet packages impersonating Braintree that steal payment card data, merchant credentials, and host secrets. The packages send data to attacker-controlled infrastructure; Socket reported them to NuGet and recommends removal and key and
Malicious Injective SDK version 1.20.21 and 17 related packages exfiltrated wallet keys and mnemonic phrases during use. The release was deprecated but remained downloadable; developers were advised to upgrade and rotate exposed credentials.
Socket Dev Research details a malicious Go module and a 222-repository GitHub lure network across 190 accounts, tracing a hidden PowerShell staging chain to Windows RAT and infostealer activity. The Go security team blocked the module.
Socket detected 17 malicious npm and PyPI packages targeting developers of PaySafe, Skrill and Neteller apps. The packages steal credentials and environment secrets, using sandbox evasion and Ngrok infrastructure for exfiltration.