Socket
4 mentions across all digests
Socket is a security company that detects and reports supply chain attacks in npm and other package ecosystems.
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI's npm package was poisoned through a compromised GitHub Action in a supply chain attack affecting 10M+ users, with the malicious code sharing infrastructure with other Checkmarx campaign tools.
Another npm supply chain worm is tearing through dev environments
A self-propagating npm worm is harvesting developer credentials from Namastex Labs packages, echoing tactics from the TeamPCP-attributed CanisterWorm campaign.
Supply Chain Attack on Axios
Attackers published malicious Axios versions (100M weekly downloads) outside the official GitHub workflow, deploying a RAT capable of remote code execution and data exfiltration.
Trivy under attack again: Widespread GitHub Actions tag compromise secrets
Supply chain attack compromised 75 of 76 Trivy-action GitHub Actions tags, injecting an infostealer payload into a widely-used CI/CD security scanning tool relied on by 10,000+ workflows.