
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
github.com/joefitzgerald/autocomplete-go
Advanced tools
autocomplete-go An autocomplete-plus provider for
the go language that uses gocode to provide suggestions.
This package requires the following packages to be installed:
Additionally, you should have gocode installed and available on your path:
go get -u github.com/nsf/gocode
If you have the go-get package installed, this package will prompt you to get gocode (if it is missing) or update gocode (if it is out of date).
I am not getting suggestions I expect!
gocode uses the output from go install to provide its suggestions. You have a few options to ensure you always get up-to-date suggestions:
go install ./... in your package when you make a changegocode set autobuild true to have gocode attempt to run go install ./... for youscopeBlacklist: Suggestions will not be shown when the cursor is inside the specified comma-delimited scope(s) (default: .source.go .comment)suppressBuiltinAutocompleteProvider: Suppress the provider built-in to the autocomplete-plus package when editing .go files (default: true)suppressActivationForCharacters: Suggestions will not be provided when you type one of the specified characters (default: comma, newline, space, tab, /, \, (, ), ", ', :, ;, <, >, ~, !, @, #, $, %, ^, &, *, |, +, =, [, ], {, }, `, ~, ?, -)snippetMode: Snippets can be generated when inserting the suggestion for a func; this option allows you to control what is generated (default: name)
name: E.g.: fmt.Println(a) with a selected such that it will be replaced on the first keystrokenameAndType: E.g.: fmt.Println(a ...interface{}), with a ...interface{} selected such that it will be replaced on the first keystrokenone: E.g.: fmt.Println(), with the cursor placed between the parenthesisFAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.