🧰 Socket AI scanner

The items that name it 6

• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
  writeup2026-10-21It is written here as Socket AI Scanner: flagged the seven malicious wheels seven minutes after publication (malware alerts at 11:46:30 UTC on 21 October 2026).

  malware alerts at 11:46:30 UTC on 21 October 2026

• Socket: Popular Rust Crates Compromised in Build-Time Supply Chain Attack
  writeup2026-08-20

  Independently detected the malicious proc-macro1 crate on August 20, 2026 at 07:29:50 UTC

• Socket: Coordinated npm/PyPI Campaign Typosquats Paysafe, Skrill, Neteller Payment SDKs
  writeup2026-07-16

  Detected the cluster of npm and PyPI malware; flagged all malicious versions as malware within 6 minutes of publication

• Socket: Fake Braintree NuGet Package Skims Credit Cards
  writeup2026-07-15

  Flagged the suspicious NuGet package as potential malware 10 minutes after publication

• Socket: Malicious Postinstall Hook Compromises 8 PHP/Node Packages on Packagist
  writeup2026-05-23

  Detected the campaign across eight branch-tracking package versions by flagging suspicious install-time behavior (postinstall hook downloading and executing an external binary)

• Mini Shai-Hulud Worm (Apr–May 2026)
  article2026-05-06

  Automated detection of the malicious intercom-client@7.0.4 package.