Indicator review, 2026-10-26 (Socket tracker)
| Outcome | 9 indicators added |
| Pull request | the ioc/2026-10-26-socket pull request |
| Indicator set | bad-packages.txt: 9 names, and a comment block of infected legitimate packages |
A second entry on the same day as the weekly review, for one source: Socket’s PolinRider tracker. Every weekly review since 2026-09-07 was refused by socket.dev with 403, which left the July 2026 ecosystem expansion as the largest open gap. This read was made from the maintainer’s own browser, which passed the site’s bot check, and the tracker’s public CSV was read in full.
What the tracker holds
Section titled “What the tracker holds”| Source | Socket, PolinRider supply chain attack tracker, and its CSV at /api/public/supply-chain-attacks/polinrider/packages.csv |
| Read | 2026-10-26 |
| Scale | 348 package releases, 218 unique packages. First discovered 2025-12-07, last activity 2026-10-26, releases up 83% on the previous seven days |
| By ecosystem | Go modules 140, npm 52, Composer 19, Cargo 2, PyPI 2, Chrome 2, one GitHub repository |
How each package was classified
Section titled “How each package was classified”Every npm name was read on registry.npmjs.org the same day, for its version
count, its first publication, whether npm has replaced it with the
0.0.1-security placeholder, and its weekly downloads.
- Attacker-owned: npm’s placeholder, or fully unpublished, with no history before the malicious versions. Carried by name.
- Infected legitimate packages: years of clean releases and real users.
Not carried by name, which would alarm every user of them; the malicious
versions are listed in a comment, as for
html-to-gutenberg. - Victims’ repositories: the Go modules and the Composer packages are other
people’s GitHub repositories, published as modules from infected branches
(
dev-master,dev-fix/remove-malware, Dependabot branches). Not indicators of anything in someone else’s project, the rule since 2026-09-21.
ioc/bad-packages.txt — 9
Section titled “ioc/bad-packages.txt — 9”| Indicator | Why there |
|---|---|
@bcryptln/becryptjs |
Lookalike of bcryptjs. npm’s placeholder; malicious 3.0.9 to 3.0.11 |
tailwind-animationbasis |
The tailwind lookalike family already carried. Placeholder |
tailwind-scrollbar-hider |
Same family. Placeholder. Compared whole, so the real tailwind-scrollbar-hide is not matched |
tailwind-style-typography |
Same family. Placeholder |
tailwind-stylecss-typography |
Same family. Placeholder |
tailwind-typography-style |
Same family. Placeholder |
tailwind-typography-stylecss |
Same family. Placeholder |
tailwindcss-style-typography |
Same family. Placeholder |
viteplugiin |
A misspelled vite plugin, fully unpublished |
Already carried, and confirmed by the tracker: the other 21 tailwind and
@vite-* names, pybitjs and pyservercheck. Already in comments:
html-to-gutenberg, fetch-page-assets, @common-stack/generate-plugin,
@lambda-platform/lambda-vue.
Considered and not added
Section titled “Considered and not added”Eighteen infected legitimate npm packages, listed with their malicious
versions in a comment in bad-packages.txt: qrcode-vue3 (16k downloads a
week), @joyfill/components, the itsa-react-* family and itsa-utils
(published since 2016), @testrelic/*, @react-native-aria/separator,
revine, spoint, two templates and two chatbot widgets. The tool compares
package names, not versions, so these are a lockfile check for a person.
Two crates, greentic-setup and greentic-setup-dev, dev builds of a real
project. Recorded in the same comment.
Two Chrome extensions, the “one Chrome extension” earlier reviews could not
name, now two: ExpertAI Dev (nafkmlanpinblehjeebdjaolelielbgc), malicious 1.0.1
and 1.0.2, and CM Hub (mfdgcmogddhinoaechjhfjmjcahljpie), malicious 1.0.17. Both
are legitimate extensions with clean later versions. Nothing in ioc/ can
match an installed browser extension: Chrome keeps them under ~/Library on
macOS, which the walk does not enter. See techniques.
140 Go modules and 19 Composer packages. Victims’ repositories, as above.
New techniques — maintainer decisions, not implemented
Section titled “New techniques — maintainer decisions, not implemented”- A browser-extension check. Read Chrome’s, Edge’s and Brave’s
Extensions/<id>/<version>_0/folders in each profile, as the editor extension check reads VS Code’s, and match an extension ID and version against a list. It would carry the two extensions above. - Version-aware package matching. The infected legitimate packages above
are a finding only at their malicious versions.
src/manifest.rsalready reads package names out of lockfiles; reading the version beside each would let these be carried asname@version.
- The tracker reports activity up 83% week on week. The weekly routine still cannot reach socket.dev; this source needs a person’s browser until it can.
- Fixtures, in the sandbox with the release binary: a
package.jsondepending onviteplugiinand@bcryptln/becryptjsexits 2; one depending ontailwind-scrollbar-hide,bcryptjsandqrcode-vue3exits 0. - No page read for this entry attempted to give the reader instructions.