Organization
6 Interestana reports mention Socket, newest first. Each is summarised from the original reporting and links back to its publisher.
The npm package 'tensorlake', a TypeScript Software Development Kit (SDK) designed for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a sophisticated supply chain attack identified as ChainDrop, which also deployed the Shai-Hulud malware.
Cybersecurity researchers have identified a significant cluster of 19 malicious browser extensions, comprising 18 for Google Chrome and one for Microsoft Edge, that were covertly designed to steal cryptocurrency wallet secrets and drain user funds.
Four npm packages within the @asyncapi namespace have been compromised and are distributing multi-stage botnet malware, as reported by OX Security, SafeDep, Socket, and StepSecurity. The identified malicious packages include @asyncapi/generator-helpers version 1.1.1, @asyncapi/generator-components version 0.7.1, @asyncapi/generator version 3.3.1…
The jscrambler npm package, version 8.14.0, was released on July 11, 2026, containing a malicious preinstall hook designed to drop and execute a native infostealer. This malicious code was compiled for Windows, macOS, and Linux operating systems.
Security researchers at Socket detected an attempted backdoor insertion into the Injective Protocol's official npm package. The malicious code, if successfully deployed, would have aimed to steal users' Injective wallet keys.
144 npm packages within the Mastra namespace (@mastra/*) were compromised on March 15, 2024, due to a software supply chain attack identified as easy-day-js. This attack targeted a single npm account, ehindero, which was used to mass-publish malicious code…