Publisher
socket.dev
Newest story built on socket.dev reporting: Cloudflare's Deno deal gives the runtime one more year of monthly fixes (October 16, 2026). socket.dev reporting informs the Build desk, most often on Software Supply Chain Security, Browser Extension Security, and Crypto Wallet Credential Theft. 21 of our current stories draw on it, the earliest from August 17, 2026.
Cloudflare is acquiring the Deno team, with one year of bug and security fixes committed for the runtime. Anyone building on Deno now has to choose between migrating and backing a community fork.
Reality
Anthropic's OSS Scanner sends maintainers Mythos findings before its researchers review them, with about 6,000 of 29,000-plus candidates triaged. The service is free and opt-in, and reports carry reproduction steps and proposed fixes where available.
Reality
arXiv now limits each submitter to two papers a month, after a record 40,363 submissions in September. The cap is the latest step in a year of tightening at a preprint server whose volunteer moderators are overwhelmed by thin, often AI-written papers.
Reality
Anthropic says normal safeguards were off and the network was live during third-party tests, and that its own pre-release auditing gave no warning. METR now gets at least eight weeks of broad access.
Perspective Coverage
5 publishersReality
Tensorlake's npm SDK 0.5.144 runs a credential-stealing worm from a preinstall hook at install time, Socket reported. According to Socket's analysis, any secret reachable from a workstation or build runner that installed the release may be exposed.
Perspective Coverage
4 publishersReality
Socket found 16 Firefox extensions posing as Rabby and OKX wallets that intercept recovery phrases and private keys during wallet import. Names and IDs rotated behind a screen that still read Rabby Wallet, so only an allowlist of exact extension IDs holds up.
Reality
The Rust Security Response Team deleted proc-macro1 and arrayref 0.3.10 on August 20 after a build script fetched and launched a binary. The lure was a yank warning.
Perspective Coverage
7 publishersReality
OpenAI now says about 700 of them chained an HDF5 bug to a Jinja2 zero-day and held root inside Hugging Face in under 13 hours. The containment gap was one service every sandbox could write to.
Perspective Coverage
3 publishersReality
OJ moves the file watcher, module graph and hot updates into a Rust binary and starts Node only for plugins. Lovable reports median sandbox acquisition dropping from 14.5 seconds to 3 seconds, and Vite's creator calls the headline cold-start benchmark somewhat misleading.
Reality
The add-on shipped to Mozilla's store as a dispatcher and took its instructions afterwards from a page it opened itself, on a domain built to resemble googleusercontent.com.
Reality
Socket reports no malicious stable release. The exposure sits with teams that resolve dev-* constraints directly, and with anyone who clones the repository and opens it in a VS Code-compatible IDE.
Reality
Socket's threat researchers found that Twitch Enhanced Viewer sends each viewer's account-scoped OAuth token to a Russian bot vendor's proxies as a query parameter, on a redirect the extension's own code shows works without it.
Reality
Socket traced six Chrome and Firefox listings to one publisher operation whose collector reaches for Firebase access tokens and Axiom bundle keys. Chrome pulled four in July 2026. The Firefox one is still up.
Reality
The Rust rewrite keeps pnpm 11's commands and lockfile, so adopting it costs little more than pulling from the next-12 tag, but the headline percentage describes a 1.5-second install and the cold case improved by about two thirds.
Reality
Socket found thirteen trojanized Composer themes across five vendor namespaces, and the front-end assets those packages ship carry an iPhone exploit chain out to the mobile visitors of every site that installs one.
Reality
Socket says all ten bad tarballs of @7nohe/openapi-react-query-codegen carry genuine GitHub Actions attestations, which is what you get when the attestation covers where a build ran rather than who wrote the commit it built.
Reality
Socket says the sharpest move in this campaign was buying utilities that already had users, then shipping the payload as version two. Install-time review had already run and passed, and the 80,000-user surface came with the purchase.
Reality
Open VSX's malicious list is an array of bare identifiers, so freeing an impersonated publisher also erases the record that the same name once shipped malware.
Reality
Browser extensions update themselves silently unless new permissions are requested. Socket says it is now watching every version of every add-on in Mozilla's directory.
Reality
Socket says 40 of the 77 extensions it tracked are confirmed credential and wallet stealers, and nine of them were repurposed from sports-score shells under the same add-on IDs.
Reality
Build · August 17, 2026 · One report1 publisher