Socket

New AISI Report Details How GPT-6 Astra Turned CTF Challenges Into Supply Chain Attacks

Earlier this month, Socket reported that GPT-6 Astra tried to plant malicious code in simulated open source projects while working on an unrelated cybersecurity challenge. The UK AI Security Institute (AISI), which had access to the model before its release, first disclosed the behavior in OpenAI’s system card. AISI has now published a dedicated technical report documenting how Astra chose targets outside the challenge’s scope, developed payloads, and tried to get maintainers to accept its…

Socket

Lire

upm Launches as a Fast, Tiny Package Manager Written in TypeScript

There's a new package manager in town, and this one fits in about 250 KB. Pooya Parsa, a longtime Nuxt contributor and creator of Nitro and UnJS, has introduced upm, a TypeScript package manager for the npm registry that uses Node.js's built-in networking, worker threads, compression, and filesystem tools. It has a JavaScript API, reads supported .npmrc settings, and can install from several other package managers' lockfiles. With so many package managers already out there, do we really need…

Socket

Lire

Socket Joins New OpenJS Program to Fund Node.js Security Work

Socket has joined the OpenJS Foundation’s new Security Stewardship Program as an inaugural partner, helping fund vulnerability research, triage, patching, and security releases across the JavaScript ecosystem. The program launches with an initial focus on Node.js, where the security workload is growing faster than the funding available to support it. “AI is driving a sharp rise in vulnerability reports, pushing many open source projects to shut down their bug bounty programs. The bottleneck is…

Socket

Lire

Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud

Update, September 25, 2026: both actions-cool/issues-helper and actions-cool/maintain-one-comment have been disabled on GitHub again, so workflows referencing them now fail at job setup instead of running the payload. Two actions-cool GitHub Actions, issues-helper and maintain-one-comment, were compromised and disabled during the May 2026 Mini Shai-Hulud campaign. Both became reachable again on September 16, 2026, and their release tags still point to malicious code, so every workflow that…

Socket

Lire

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

Socket identified a Firefox extension that ships with no hardcoded malicious code and fetches a remote payload after installation to silently automate Google account takeover, targeting Portuguese- and Spanish-speaking users since September 11, 2026. Socket's Threat Research team identified a malicious Firefox extension posing as a utility for identity verification before opening protected PDF documents. The extension, pdf-para-texto@extensao.local, was published to the Firefox Add-ons store on…

Socket

Lire

MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack

The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Its main GitHub repository has about 11,500 stars and 1,100 forks. Four malicious releases, three of the npm package @memtensor/memos-cloud-openclaw-plugin and one of the PyPI package MemoryOS, each currently the latest version on its registry, drop cross-platform Go binaries that search developer home directories for secrets and report to servers under skyleen[.]fr.…

Socket

Lire

Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source

Lovable is beginning to replace Vite inside its cloud preview environments with OJ, a Rust-based build tool created for the demands of running around one million short-lived development sandboxes per day. The company reported that OJ reduced median sandbox acquisition time from 14.5 seconds to 3 seconds and cut the memory used by the dev server process by roughly 6.5x in a controlled production rollout. OJ arrives as part of the trend toward rewriting JavaScript tooling in Rust. Other examples…

Socket

Lire

Happy Birthday, Shai-Hulud

This week marks one year since an attacker pushed a malicious version of @ctrl/tinycolor to npm, kicking off the worst year for npm security on record. At the time, the package was downloaded more than two million times a week. Within a day the same code was spreading on its own across dozens of packages, and then into CrowdStrike's npm namespace. It was the first known self-propagating worm in the npm ecosystem, and it has not really stopped since. The tinycolor compromise put software supply…

Socket

Lire

PolinRider Spreads Through Compromised GitHub Accounts and Packagist

Socket researchers identified malicious code in the dev-main version of visanduma/nova-two-factor, a Packagist package with more than 700,000 cumulative downloads, as the PolinRider campaign continues to spread through compromised developer accounts and Git repositories. The Socket Threat Research Team continues to track malicious activity associated with PolinRider. In our July research post, we provided initial technical details about this persistent campaign, which distributes malware across…

Socket

Lire

GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk

GitHub has added cache-mode to GitHub Actions, a new setting that limits how workflows and jobs can access the Actions cache. It targets cache poisoning, the technique attackers used to compromise the Ultralytics PyPI package in 2024 and the TanStack npm packages in May 2026. Cache poisoning works because an entry written to the shared Actions cache in one context can be restored and run in another. An attacker who gains write access to a cache key that a trusted workflow later reads can plant…

Socket

Lire

Jerod Santo Joins Socket as Head of Media

We need to talk. Supply chain attacks are going parabolic in both frequency and impact. There are so many hacks now that we gussy ‘em up with names like GemStuffer, SANDWORM_MODE, and TrapDoor just to keep track of the onslaught. (Remember Heartbleed? The O.G. (Original Gussy)) We’ve also got frontier models escaping their sandboxes to hack third parties, zero-click worms spreading through WeChat without any user interaction, AI-discovered zero days being used by criminal enterprises, and so…

Socket

Lire

Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service

Socket’s Threat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons (twitchenhancedviewer@example.com, 552 users). Both listings are live at time of writing. Current builds (v85.x) forward the token inline…

Socket

Lire

Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack

Anthropic has revised its assessment of the Claude cybersecurity evaluation incidents it disclosed in July. What it initially described as primarily a containment and operational failure also exposed two recurring alignment problems: models selectively interpreted evidence to justify continuing their work, then kept pursuing their assigned task despite the risk of real-world harm. Anthropic identified those behaviors as biased reasoning and recklessness in its latest alignment assessment: Our…

Socket

Lire

Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data

Socket uncovered a cross-browser extension operation targeting cryptocurrency traders. Four malicious Chrome and Firefox extensions steal authenticated Axiom Trade and Padre session and wallet-related data, while two earlier extensions linked to the same publisher operation reveal a longer-running pattern of repackaging crypto trading tools. The Socket Threat Research team identified six Chrome and Firefox extensions linked through a combination of shared code, command and control (C2)…

Socket

Lire

GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing

OpenAI has released GPT-6 Astra, its first model to reach the company’s Critical cybersecurity capability threshold, with a perfect score on the public ExploitBench benchmark and autonomous discoveries of exploitable zero-day vulnerabilities in browser and operating system targets. There is something unintentionally comical about the generational comparison in OpenAI’s announcement. Astra is the more sophisticated, better-aligned guest you can trust at a formal dinner party, excelling at…

Socket

Lire