Research reports
1,224 reports from 387 publishers45 added in the past week
3 reports, newest added first
Added Fri 31 Jul
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Socket proactively blocks malicious open source packages in your code. Install Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static…
MalwareSupply chain
Added Wed 29 Apr
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40 Packages
Socket proactively blocks malicious open source packages in your code. Install Update (September 16, 2025): This campaign has expanded significantly. Our follow up documents nearly 500 affected npm packages, including several open source CrowdStrike packages.…
Supply chain
GlassWorm Loader Hits Open VSX via Developer Account Compromise
Socket proactively blocks malicious open source packages in your code. Install Socket’s Threat Research team identified a developer-compromise supply chain attack distributed via the Open VSX Registry, specifically a compromise of the developer’s publishing…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.