[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-ZAjiQsm7ZLeKS2d6EXrWnZRPSCMIzIRRXALgiyTX_A":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"7e6ca802-2573-491b-a051-cfddbc35dcf2","Free Business Plan Upgrades for Open Source Maintainers","free-business-plan-upgrades-for-open-source-maintainers-553e64","This week our Threat Research team tracked an active supply chain attack that took over a maintainer account and used it to push malware across the widely used keyv and cacheable packages, then spread to other maintainers through stolen npm tokens. Those packages sit deep in dependency trees and account for tens of millions of weekly downloads. Attacks like this are getting more frequent, and open source maintainers are the ones on the receiving end. When an account takeover happens, the maintainer is often the last to find out and the first to deal with the fallout, usually alone. And usually for software they maintain for free. Maintaining critical software now comes with a security burden that has outgrown what any volunteer can reasonably carry. Earlier this year a coordinated social engineering campaign hunted high-impact Node.js maintainers, going after the people behind some of the most depended-on packages in npm. Several Socket engineers were targeted in it, including me. Maintainers are now targets for AI-driven attacks too, from agents that social-engineer their way toward a malicious merge to agents that patiently build a real contribution history to earn a maintainer's trust. AI keeps lowering the barrier to this kind of activity, while maintainers stand as the last human gatekeepers in the supply chain. Socket is built by open source maintainers. Our team's software is downloaded over a billion times a month, and we know the work and the exposure that come with it. We want to do more. Free Business plan for open source projects # Since 2024 we have offered open source projects a free upgrade to our Team plan. Starting today we are raising that to a free Business plan. That gives maintainers Socket's full protection at no cost, including: Automatic blocking of malicious dependencies across 80+ risk types Reachability analysis Scanning for GitHub Actions and AI models, the same CI and agent surfaces attackers are now abusing SBOM export, SSO\u002FSAML, and webhook automation Unlimited members and repository labels # The program is open to any public open source project under a valid OSI license. Sign up for Socket for free, then email support@socket.dev with your GitHub organization name. We will upgrade you to the Business plan and you can start using the additional features right away. If you already have a free Team upgrade through the program, email the same address and we will move you to Business. Securing the packages the world depends on should not fall on maintainers alone. This is one way we can carry more of that weight.","A recent supply chain attack compromised maintainer accounts for the keyv and cacheable npm packages, pushing malware and spreading via stolen tokens. This highlights the increasing security burden on open source maintainers. In response, Socket is upgrading its free offering for open source projects from a Team plan to a Business plan, providing enhanced security features at no cost.","Socket offers free Business plan upgrades to open source projects facing supply chain attacks.","https:\u002F\u002Fsocket.dev\u002Fblog\u002Ffree-business-plan-upgrades-for-open-source?utm_medium=feed","https:\u002F\u002Fcdn.sanity.io\u002Fimages\u002Fcgdhsj6q\u002Fproduction\u002Ff6a33a06fe723dc0c49f44f2a9754b53373ecdb4-1672x941.png?w=1000&q=95&fit=max&auto=format","2026-08-07T06:49:17.32+00:00","2026-08-08T00:00:04.887353+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"keyv","product",{"name":21,"type":19},"cacheable",{"name":23,"type":24},"npm","technology",{"name":26,"type":27},"Socket","vendor",{"name":29,"type":24},"AI",{"name":31,"type":24},"GitHub Actions","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":57,"context":58},"malware","Malware pushed via compromised npm packages.",[26,18,21],{"controls":61,"vendors":145},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":54,"name":92,"problem":93,"products":94},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":120,"name":121,"problem":122,"products":123},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":141,"product_name":142,"url":143,"description":144},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[146],{"slug":147,"name":26,"logo_path":148,"roles":149},"socket","\u002Fvendor-logos\u002Fsocket.png",[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":165},"npm-supply-chain-attack-compromises-open-source-maintainer-accounts-via-stolen-tokens","npm Supply Chain Attack Compromises Open Source Maintainer Accounts via Stolen Tokens","Attackers compromised maintainer accounts for the widely-used 'keyv' and 'cacheable' npm packages by stealing authentication tokens, then pushed malicious code to downstream users. This is a classic supply chain attack: rather than targeting end users directly, adversaries exploit the trust placed in open source maintainers to distribute malware at scale. The incident underscores that open source maintainers — often volunteers with limited resources — are high-value targets whose credentials and tokens can propagate malware to thousands of dependent projects. Without robust token management, multi-factor authentication, and proactive dependency scanning, organizations consuming open source packages remain silently exposed.",[156,157,158,159,160,161,162,163,164],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management","NIST SP 800-218 SSDF: PO.5.2 (Secure Software Development Framework)","NIST CSF: ID.SC-4 (Supply Chain Risk Management)","SLSA Framework: Supply chain Levels for Software Artifacts","OpenSSF Scorecard: Token permissions and dependency pinning checks","NIST AC-2: Account Management (credential and token lifecycle)","NIST IA-5: Authenticator Management (MFA enforcement)",{}]