🧰 Socket.IO

The items that name it 4

• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeupas tools2026-10-30

  Protocol used by the RAT for operator commands and by the hunting guidance

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeupas tools2026-09-20

  Used by the final 77KB RAT (via socket.io-client) to establish a remote-control command-and-control channel to the attacker.

• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  writeupas classification.technologies2026-07-30
• INC RANSOMWARE: THREAT INTELLIGENCE
  writeupas tools2026-07-24

  Real-time chat/messaging between victim and ransomware group via events like ROOM:JOIN, ROOM:NEW_MESSAGE

In every workspace you can read 5