Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
- Ola Adekola
When a new malware campaign emerges, you need to know whether it reached your organization and whether your defenses stopped it. Socket Threat Intel now makes those answers easier to find, with campaign summaries that show what Socket blocked or detected and links to the scans and Firewall events behind them.
Every malware campaign on the Threat Intel → Campaigns page now carries a real-time summary for your organization: Blocked by Socket, Detected in Firewall/SCA, or Not Detected.
Each summary pulls from immutable full scans of your repositories, immutable diff scans (i.e. from pull requests), and Socket Firewall event traffic. That means Threat Intel now shows more than just whether a campaign package made it into your code — we also show when malicious campaigns are Blocked by Socket.
Click any campaign and open the Org Impact tab to see more details. Each campaign package found in your organization is listed with the repositories and branches that contained it, along with the first and last time it was seen. Every date links straight to the scan report or to the matching Socket Firewall events, so you can go from "were we hit?" to the exact scan or install in just a few clicks.
For campaigns involving multiple packages, the Org Impact tab shows each package and version separately, with its own status and first and last seen dates. In the keyv and cacheable campaign below, you can see which malicious package versions Socket blocked and follow the date links to the corresponding events.
Additionally, you can find Socket blogs covering the campaign and the complete list of affected packages in the Blog and Affected Packages tabs.
Head to Threat Intel → Campaigns in the Socket dashboard to see what Socket has blocked or detected in your organization. Open a campaign’s Org Impact tab to trace detections to specific repositories, branches, scans, and Firewall events, so your team can assess exposure and investigate with the supporting evidence in hand.
