Intelligence Feed

1mo ago · socket-dev

A new wave of the Miasma Mini Shai-Hulud supply chain attack has compromised npm packages under LeoPlatform and RStreams, as well as a Go module associated with Verana Blockchain. The campaign uses malicious binding.gyp files in npm packages to trigger JavaScript execution during installation, stages payloads via Bun, and targets developer environments, CI/CD pipelines, and GitHub Actions for credential theft. It also spreads through poisoned repositories and source configurations, with persistence mechanisms targeting AI coding assistants and IDEs. The activity overlaps with prior incidents involving the same malware family and operational markers like 'RevokeAndItGoesKaboom'.

1mo ago · socket-dev

The Rolldown and Vite projects withdrew a Rust-based React Compiler integration due to a 17% increase in binary size, raising concerns about framework-specific bloat in otherwise agnostic tools. The integration, funneled through the Oxc project, aimed to improve build performance but faced criticism for imposing costs on all users regardless of React usage. The debate highlights a broader tension in frontend tooling between performance gains from native Rust integrations and the overhead of larger binaries, with potential implications for other frameworks like Vue, Svelte, and Angular.

1mo ago · socket-dev

The Miasma Mini Shai-Hulud supply chain campaign has expanded to compromise legitimate @immobiliarelabs npm packages, specifically Backstage plugins for GitLab and LDAP authentication. Malicious versions were published on June 26, 2026, using a hidden root-level index.js to execute a multi-stage payload that steals developer and CI/CD secrets, including tokens, SSH keys, and cloud credentials. The attack leverages GitHub Actions deployment triggers and may have originated from a compromised third-party GitHub Action, codfish/semantic-release-action, enabling further propagation through poisoned workflows and exfiltration to attacker-controlled repositories.

1mo ago · socket-dev

Malicious Chrome and Firefox browser extensions branded as 'VPN Go: Free VPN' have been distributing clipboard-stealing malware through staged updates. Initially appearing as legitimate free VPN tools, the extensions later added functionality to monitor and exfiltrate clipboard data, including passwords, API keys, and cryptocurrency addresses. The stolen data is sent to hardcoded IP addresses using HTTP GET requests with chunked encoding and session identifiers. Both extensions use obfuscated JavaScript and share infrastructure, indicating a coordinated campaign targeting user privacy under the guise of security.

1mo ago · socket-dev

The article discusses a surge in software supply chain attacks, where threat actors compromise popular open source packages and leverage trusted development workflows to distribute malicious code. The rise of AI coding agents exacerbates the risk by automatically pulling in dependencies without sufficient review, increasing the speed and scale of potential compromise. Attackers are targeting development tools such as package registries, IDE extensions, and source repositories, often evading traditional security measures.

1mo ago · socket-dev