
Threat Research
/Security News
Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
@github/copilot-sdk-linux-x64
Advanced tools
This is the production release of the GitHub Copilot Browser extension and Browser Use Copilot CLI plugin. The browser extension and plugin are published as separate artifacts and must use the same product version.
node --version works in a terminal.Install GitHub Copilot from the Chrome Web Store. Browser confirmation is required; the Copilot plugin does not install the extension or grant its permissions automatically.
The same Chrome Web Store listing supports Microsoft Edge. If Edge prompts you, select Allow extensions from other stores, confirm the choice, and then add the extension. A separate Microsoft Edge Add-ons listing is not currently required.
If the extension is already installed, confirm that it is enabled. The production release does not use an unpacked extension.
Until the Copilot plugin marketplace entry is available:
/plugin install <absolute-path-to-the-extracted-plugin-directory>.The plugin's sessionStart hook activates Browser registration automatically. To use Browser
immediately in the current session, run /browser-use:doctor first and follow its
reported next action. Use /browser-use:activate only when diagnostics recommend
activation or when you explicitly need to make this installation active.
Run /browser-use:doctor for read-only installation and connectivity diagnostics.
If the extension is not connected:
browser-extension check's installation or enablement guidance;/browser-use:activate when Browser registration is incomplete;The plugin does not infer that the extension is missing solely because no Native Host is connected.
Ask Copilot to complete a task in the browser. The browser-use skill loads automatically when live
browser interaction is needed. Review browser prompts and approve only requests you initiated.
Complete sign-in and other sensitive steps yourself.
Advanced Page Surfaces is available as a default-Off experimental setting in production builds. Open the extension's Manage page to enable it for new Browser Connections when a task needs approved iframe or closed Shadow Root access.
/browser-use:deactivate./plugin uninstall browser-use.The main JavaScript/TypeScript SDK for building applications around GitHub Copilot sessions. Unlike the Linux x64 package, it exposes the developer-facing client and session APIs; the platform package is a supporting component.
Anthropic's Claude Code npm package provides a coding-agent CLI. It is comparable as a way to run an AI coding agent, but is a CLI product rather than a Linux-specific Copilot SDK component.
OpenAI's Codex npm package provides a coding-agent CLI. It offers an agent workflow in a different product ecosystem and is not a platform package for the Copilot SDK.
Google's Gemini CLI is an npm-distributed terminal agent for working with Gemini. It is similar in the broad sense of enabling AI-assisted coding, but provides its own CLI and APIs rather than Copilot's Linux x64 runtime component.
FAQs
Platform runtime for @github/copilot-sdk (linux-x64)
The npm package @github/copilot-sdk-linux-x64 receives a total of 899,037 weekly downloads. As such, @github/copilot-sdk-linux-x64 popularity was classified as popular.
We found that @github/copilot-sdk-linux-x64 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 27 open source maintainers collaborating on the project.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.