Props to their Threat Research team for identifying and publicizing these harmful packages. If you want to understand what the code does, check out their post.

Bottom line: Always verify your dependencies and their sources!

socket.dev/blog/9-ma...
6/6

The evidence also doesn't rule out security research as an explanation.
I’d give this a low confidence assessment for malicious intent. That said, it's normal for analysts to reach different conclusions, and this isn't a criticism of Socket's solid technical analysis.
5/6

- The lure isn't convincing.
- The packages are unpopular (even by Socket's metrics), so infection of new projects seems improbable.
- Why would existing projects switch to the malicious dependencies?
- There's no C2 code to confirm victims. How would an attacker know if this worked?
4/6

While I agree the code is harmful and the packages are suspicious, I'm not convinced about the supply chain attack angle -- or if it is one, it’s not a particularly effective one. Several factors give me pause:
3/6

No legitimate projects were compromised, and no S7, Sharp7, or Siemens codebases were modified. Socket identified packages published by a separate user ("shanhai666") containing code that probabilistically kills host processes and causes database write failures within specific date ranges.
2/6

“No, that’s my neighbor, Bobby. I live at 502, but you have to write 501 on the package or the mail carrier brings it to the wrong house. He has a problem.”

ICS is fun. This blog covers the problem:
blog.softwaretoolbox.com/topserver-mo...

(H/T to Reid Wightman for inspiring this post)

(2/2)

Other questions I'm exploring:

How much does AI know about ICS protocols?

Does AI truly lower the barrier for entry? If not, is that an AI limitation or am I just "holding it wrong"?

Is it shortening my development time? Or solving some problems but creating new ones for a net-zero benefit?
2/2

MinusOne, a deobfuscation engine for scripting languages: github.com/airbus-ce...

EPIC Erebus for PCIe and DMA attack research: www.crowdsupply.com/...
3/3

Here are a few of the projects I enjoyed learning about this time around:

Thorium Malware Pipeline: github.com/cisagov/t...

CTADL Static Taint Analysis Tool: github.com/sandialab...
2/3

I couldn’t think of a picture, so here’s an image from an old show that probably planted the seed for me to become a malware analyst.

I enjoyed it, but I’ll readily admit, it’s not for everyone.

I learned about it reading Orange’s write up in Phrack72: phrack.org/issues/72...

And the blog post it references here by Orange and Splitline: devco.re/blog/2025/0...

Both of these are excellent write ups and great reads if you’re into vulnerability research, CTFs, or hacker history.
3/3