惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

L
LangChain Blog
月光博客
月光博客
S
SegmentFault 最新的问题
博客园 - 三生石上(FineUI控件)
Last Week in AI
Last Week in AI
J
Java Code Geeks
酷 壳 – CoolShell
酷 壳 – CoolShell
TaoSecurity Blog
TaoSecurity Blog
V
Visual Studio Blog
博客园 - 叶小钗
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
T
Threat Research - Cisco Blogs
罗磊的独立博客
雷峰网
雷峰网
T
Tor Project blog
L
LINUX DO - 最新话题
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
博客园 - 司徒正美
Apple Machine Learning Research
Apple Machine Learning Research
Scott Helme
Scott Helme
Spread Privacy
Spread Privacy
C
CERT Recently Published Vulnerability Notes
腾讯CDC
Cloudbric
Cloudbric
WordPress大学
WordPress大学
Security Archives - TechRepublic
Security Archives - TechRepublic
V
V2EX
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
N
News and Events Feed by Topic
T
Troy Hunt's Blog
T
Threatpost
C
Check Point Blog
Vercel News
Vercel News
I
Intezer
Engineering at Meta
Engineering at Meta
C
Cybersecurity and Infrastructure Security Agency CISA
D
DataBreaches.Net
SecWiki News
SecWiki News
Help Net Security
Help Net Security
Microsoft Azure Blog
Microsoft Azure Blog
Google DeepMind News
Google DeepMind News
S
Secure Thoughts
T
The Blog of Author Tim Ferriss
The GitHub Blog
The GitHub Blog
Hacker News: Ask HN
Hacker News: Ask HN
AI
AI
N
News and Events Feed by Topic
阮一峰的网络日志
阮一峰的网络日志
B
Blog RSS Feed
Attack and Defense Labs
Attack and Defense Labs

Socket

White House Launches Gold Eagle Initiative to Manage Surge i... Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Mu... Next.js moves to scheduled security releases - Socket 11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windo... Compromised npm Packages in the AsyncAPI Namespace Deliver M... jscrambler npm Package Compromised in Supply Chain Attack - ... Fake Braintree NuGet Package Skims Credit Cards and Harvests... Compromised Injective SDK npm Package Exfiltrates Wallet Key... npm v12 Ships With Install Scripts Off by Default, Begins De... Malicious Go Module Exposes GitHub Malware Lure Network Span... pnpm 11.10 Hardens Registry Authentication to Block Token Re... Coordinated npm and PyPI Campaign Typosquats Popular Secure ... Node.js Considers Public Workflow for Security Reports Amid ... PolinRider: North Korea-Linked Supply Chain Campaign Expands... Risky Biz Podcast: AI Agents Are Raising the Stakes for Soft... Chrome and Firefox Extensions Posing as Free VPNs Add Clipbo... Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages - S... Rolldown Pulls Rust React Compiler Integration After Binary ... Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and Git... Frontier AI Is Now Critical Infrastructure - Socket The Code You Didn't Write Is Still Yours to Defend - Socket GitHub Actions Checkout Now Blocks Risky pull_request_target... Introducing Repository Access Permissions and Custom Roles -... Socket MCP Adds Org Alerts, Threat Feed Review, and Package ... Socket Firewall Now Blocks Malicious VS Code and Open VSX Ex... 140+ Mastra npm Packages Compromised in Coordinated Supply C... npm Package Uses Prompt Injection and Token Flooding to Disr... Introducing Manifest Alerts - Socket GlassWASM: WebAssembly Malware Found in Trojanized Open VSX ... Socket for Linear Is Now Available - Socket US Government Forces Anthropic to Pull Claude Fable Days After Launch 152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Faked Google Search Traffic Andrew Becherer Joins Socket as Chief Information Security Officer Socket Partners with Replit to Block Malicious Packages in AI-Powered Development npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems pnpm 11.5 Adds Support for Recognizing npm Staged Publishes pnpm 11.5 Adds Support for Recognizing npm Staged Publishes Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages Famous Chollima Targets PHP Developers Through Compromised Packagist Package Famous Chollima Targets PHP Developers Through Compromised Packagist Package Rust Moves to Restrict LLM Use in Contributions After Months of Internal Debate Rust Moves to Restrict LLM Use in Contributions After Months of Internal Debate Malicious NuGet Package Impersonates Sicoob SDK to Exfiltrate Banking Certificates and Passwords Malicious NuGet Package Impersonates Sicoob SDK to Exfiltrate Banking Certificates and Passwords Feross on TBPN: Socket's Series C and the State of Software Supply Chain Security Feross on TBPN: Socket's Series C and the State of Software Supply Chain Security OSV Withdraws 157 Malware Reports After Automated False Positives Hit npm and PyPI OSV Withdraws 157 Malware Reports After Automated False Positives Hit npm and PyPI TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io Laravel Lang Compromised with RCE Backdoor Across 700+ Versions Malicious Postinstall Hook Found Across 700+ GitHub Repositories, Including Packagist and Node.js Projects AI Has Taken Over Open Source npm Invalidates Granular Access Tokens as Mini Shai-Hulud Sweeps the Registry Coruna Respawned: Compromised art-template npm Package Leads to iOS Browser Exploit Kit Socket raises $60M Series C at $1B valuation led by Thrive Capital to secure AI-driven software development Socket Raises $60M Series C at a $1B Valuation to Help Enterprises Build Securely With AI Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor Active Supply Chain Attack Compromises @antv Packages on npm Popular node-ipc npm Package Infected with Credential Stealer TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks Packagist Urges Immediate Composer Update After GitHub Actions Token Leak GemStuffer Campaign Abuses RubyGems as Exfiltration Channel Targeting UK Local Government Socket Named to Rising in Cyber 2026 List of Top Cybersecurity Startups TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack fsnotify Maintainer Dispute Sparks Supply Chain Concerns Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape 5 Malicious NuGet Packages Impersonate Chinese UI Libraries to Distribute Crypto Wallet and Credential Stealer pnpm 11 Adds Supply Chain Protection Defaults for Minimum Release Age and Exotic Subdependencies PyPI Fixes High-Severity Access Control Issues Found in Security Audit Malicious Ruby Gems and Go Modules Impersonate Developer Tools to Steal Secrets and Poison CI Mini Shai-Hulud Spreads to Packagist: Malicious Intercom PHP Package Follows npm Compromise Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack lightning PyPI Package Compromised in Supply Chain Attack Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables SAP CAP npm Packages Hit by Supply Chain Attack Socket Has Acquired Secure Annex 73 Open VSX Sleeper Extensions Linked to GlassWorm Show New Malware Activations Introducing Reachability for PHP Introducing Data Exports Malicious Checkmarx Artifacts Found in Official KICS Docker Repository and Code Extensions Introducing Reports: An Extensible Reporting Framework for Socket Data Socket for Jira Is Now Available Socket Named Top Sales Organization by RepVue NIST Officially Stops Enriching Most CVEs as Vulnerability Volume Skyrockets Socket Selected for OpenAI's Cybersecurity Grant Program Feross on the 10 Minutes or Less Podcast: Nobody Reads the Code 108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure Node.js Drops Bug Bounty Rewards After Funding Dries Up The Hidden Blast Radius of the Axios Compromise
Introducing Organization Notifications in Socket
Alex Morais · 2026-04-22 · via Socket

Sidebar CTA Background

Secure your dependencies with us

Socket proactively blocks malicious open source packages in your code.

Install

Today, we’re excited to launch Organization Notifications in Socket.

This new feature gives teams a direct way to stay on top of organization alert activity without relying on someone to constantly watch the dashboard. With Organization Notifications, you can subscribe to organization-level alert events, filter the kinds of alerts you care about, and send batched updates to a configured destination. We're launching the email channel type first, and Slack and Microsoft Teams support are planned next.

Organization alerts already help surface important security issues across your repositories. Organization Notifications builds on that by making those updates easier to route, review, and act on. Instead of turning every alert into a separate interruption, Socket groups matching activity into periodic summaries so teams can stay informed without adding more noise.

Create a Channel and Subscribe to Organization Alert Events#

The feature is managed from a new Notifications page in organization settings. Teams first create a notification channel, then attach subscriptions to it. When configuring email as a channel, Socket marks it as verification pending until the recipient confirms ownership. After verification, that address can be used as a notification destination.

Once a channel is in place, teams can create subscriptions for the alert activity they want to receive. At launch, Socket supports three organization alert events:

  • organization alert created
  • organization alert changed
  • organization alert cleared

This makes it possible to track the full lifecycle of an alert, from the moment it appears to later changes and eventual resolution. The changed event also covers updates to the alert itself, including cases where a new repository is added to that alert.

Filter for the Alerts That Matter#

Subscriptions can be scoped by category, severity, priority, and repository. If a filter is left unset, Socket treats it as matching any value for that field. To keep notifications targeted, users currently need to choose at least one filter before creating a subscription.

That gives teams a practical way to route the right alert activity to the right inbox, whether they want to focus on a specific repository, a certain class of alert, or the highest-priority issues first.

Get Batched Updates Instead of Inbox Spam#

Organization Notifications is designed to reduce noise, not add to it. Instead of sending one email per alert, Socket batches updates together and sends email at most once every 20 minutes. If there are new or updated alerts during that window, the email includes a summary of what changed. If there is nothing new to report, nothing is sent.

That batching model gives teams a steady signal without turning routine alert activity into a flood of notifications.

Notification emails include a priority summary, a sample list of updated alerts from the latest batch, and a link back to the alerts view in the Socket dashboard. Emails display up to 20 alerts and indicate when more alerts were included in the batch than are shown in the message itself.

Get Started#

Organization Notifications gives teams a better way to operationalize organization alerts in Socket. Instead of relying on someone to manually check for changes, teams can define what matters, control where updates go, and get a digestible summary when alert activity happens.

If you’re interested in trying Organization Notifications, get in touch with the Socket team to enable the feature for your organization. The feature is available on Team, Business, and Enterprise plans.