Unverified NPM Account Takeover Vulnerability for Sale on Dark Web Forum(socket.dev)

35 points by feross 2 years ago | 3 comments

Libxml2 Maintainer Ends Embargoed Vulnerability Reports, Citing Unsustainable(socket.dev)

4 points by feross 1 year ago | 0 comments

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign(socket.dev)

844 points by tosh 6 months ago | 412 comments

Socket Research blog post reporting that Bitwarden CLI 2026.4.0 was compromised via an abused GitHub Action as part of the Checkmarx supply chain campaign.

Trivy under attack again: Widespread GitHub Actions tag compromise secrets(socket.dev)

223 points by jicea 7 months ago | 79 comments

Social engineering campaign targeting tech employees spreads through NPM malware(socket.dev)

106 points by feross 3 years ago | 71 comments

Polyfill supply chain attack hits 100K+ sites(sansec.io)

738 points by gnabgib 2 years ago | 304 comments

Sansec threat research post reporting that the new Chinese owner of the Polyfill JS project is injecting malware into more than 100,000 websites.