
Threat Research
/Security News
Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
Webhook tunnel: expose localhost on a public URL, then inspect, replay and debug every webhook. Downloads the native pipehero binary on install.
Webhook tunnel for developers: expose your localhost on a public URL, then inspect, replay and debug every webhook — solo or with your team.
npm install -g pipehero
pipehero login
pipehero start myapp --port 3000
# → https://myapp.t.pipehero.app forwards to localhost:3000
Point Stripe, GitHub, Shopify or any provider at your public URL and every request shows up live — headers, body, signature ✓/✗ — with one-click replay to localhost. Webhooks that arrive while you're offline are captured and replayable too.
Ships an MCP server so your AI agent (Claude Code, Cursor, …) can read and replay your webhooks:
claude mcp add --transport http pipehero https://mcp.pipehero.app/mcp
This package downloads the prebuilt native binary for your platform (macOS/Linux, x64/arm64) on install. Other install options:
curl -fsSL https://pipehero.app/install | sh
brew install pipehero/tap/pipehero
FAQs
Webhook tunnel: expose localhost on a public URL, then inspect, replay and debug every webhook. Downloads the native pipehero binary on install.
The npm package pipehero receives a total of 31 weekly downloads. As such, pipehero popularity was classified as not popular.
We found that pipehero demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.