Socket Links Malware Campaigns to Blocked Installs and Repository Scans

Socket now shows organization-specific campaign impact in Threat Intel → Campaigns. Its three labels are “Blocked by Socket,” “Detected in Firewall/SCA,” and “Not Detected.” The view draws from immutable full repository scans, immutable pull-request diff scans, and Socket Firewall events. A blocked install and a package found in a repository need different follow-up.

Open a campaign’s Org Impact tab. For each package and version found, follow the first- and last-seen date links to the scan report or Firewall event. The view lists the relevant repositories and branches, so you can check the exact dependency and proposed change. Socket’s example identifies malicious versions of keyv and cacheable; match versions to the linked records to scope each finding.

If Socket blocked an install, inspect the linked event and check whether a scan also finds the package in a repository. If a scan detects it, remove the malicious version, review the affected branch and deployments, then re-run the scan. For Not Detected, compare your repository and install coverage with the paths where packages enter your environment; check unscanned repositories and unobserved installs separately. The follow-up should leave a version-specific scan result and a corresponding install-event record where one exists.