--- title: 737 malicious VPN extensions hit Chrome Web Store, React... description: Socket found 737 fake VPN extensions in the Chrome Web Store routing traffic through Russian-controlled proxies — 516 are still live. React Native 0.87 ships... canonical: https://daily.dev/posts/737-malicious-vpn-extensions-hit-chrome-web-store-react-native-0-87-drops-strict-typescript-api-eyhkntdst twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 737 malicious VPN extensions hit Chrome Web Store, React Native 0.87 drops strict TypeScript API | daily.dev og:description: Socket found 737 fake VPN extensions in the Chrome Web Store routing traffic through Russian-controlled proxies — 516 are still live. React Native 0.87 ships... og:url: https://daily.dev/posts/737-malicious-vpn-extensions-hit-chrome-web-store-react-native-0-87-drops-strict-typescript-api-eyhkntdst og:image: https://api.daily.dev/og/posts/eyhkNtDSt.png og:image:alt: 737 malicious VPN extensions hit Chrome Web Store, React Native 0.87 drops strict TypeScript API og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 737 malicious VPN extensions hit Chrome Web Store, React Native 0.87 drops strict TypeScript API **[Web Digest](https://daily.dev/sources/webdev_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Socket found 737 fake VPN extensions in the Chrome Web Store routing traffic through Russian-controlled proxies — 516 are still live. React Native 0.87 ships with the Strict TypeScript API as default and Metro getting 2x faster source maps. Chrome's Device Bound Session Credentials landed on macOS in Chrome 147, extending the Windows TPM support from Chrome 145. Linear migrated to StyleX after 1,000 PRs and saw ~30% faster in-app navigation. ## Content **TLDR:** Socket found 737 fake VPN extensions in the Chrome Web Store routing traffic through Russian-controlled proxies — 516 are still live. React Native 0.87 ships with the Strict TypeScript API as default and Metro getting 2x faster source maps. Chrome's Device Bound Session Credentials landed on macOS in Chrome 147, extending the Windows TPM support from Chrome 145. Linear migrated to StyleX after 1,000 PRs and saw ~30% faster in-app navigation. --- ## 737 malicious VPN extensions in Chrome Web Store, 516 still active Socket's Threat Research Team found 737 fake VPN and proxy extensions across at least 40 developer accounts, impersonating brands like NordVPN and ProtonVPN. All 520 analyzed extensions point to the same SOCKS5 proxy infrastructure on port 1082, controlled by a single Russian operator — an earlier version of their privacy policy explicitly committed to sharing user data with Russian state authorities. The extensions got through review by submitting nine byte-identical privacy justification documents falsely claiming no external data transmission, then swapping in remote configuration post-approval. Google has removed 221; the remaining 516 have 58,318 combined installs. If you're running a free VPN extension, check the list. [Read more](https://daily.dev/posts/xRztlQrbD) ## React Native 0.87 ships Strict TypeScript API as default, Metro gets 2x faster source maps React Native 0.87 makes the Strict TypeScript API the default — types are now auto-generated from source rather than hand-maintained, and deep imports into internal paths are blocked. Metro 0.87 brings 2x faster source map generation and 50% lower memory usage. The release also adds experimental Swift Package Manager support for iOS as a CocoaPods alternative, raises minimum toolchain requirements to Node.js 22 and Kotlin 2.0+, and removes a batch of deprecated APIs including InteractionManager and several StatusBar props. Worth auditing your imports before upgrading. [Read more](https://daily.dev/posts/n4G0WM71v) ## DBSC lands on macOS in Chrome 147, here's how to verify your assignment Device Bound Session Credentials — which bind session cookies to hardware-backed keys in the Secure Enclave — arrived on macOS in Chrome 147, following the Windows TPM rollout in Chrome 145. The rollout is gradual via Finch, so many users are in a control group with the key service disabled. You can check your assignment at chrome://version/?show-variations-cmd and force-enable it with specific --enable-features flags for local testing. One gotcha: enabling the top-level DeviceBoundSessions flag does nothing if UseUnexportableKeyServiceInBrowserProcess is off. For site operators, browsers without DBSC support simply ignore the registration header and fall back to normal cookie sessions. [Read more](https://daily.dev/feed-by-ids?id=euKyfajKc&id=8zoYBvPhu) ## Linear migrated to StyleX after 1,000 PRs, in-app navigation is ~30% faster Linear completed a full styling migration to StyleX across 1,000 pull requests and measured roughly 30% faster in-app navigation as a result. That's a meaningful real-world data point for teams evaluating atomic CSS-in-JS approaches — StyleX's static extraction and minimal runtime overhead appear to pay off at scale in a production app with Linear's complexity. [Read more](https://daily.dev/posts/jvDZRPt8e) --- ## Also notable - **Bun's next version brings up to 281x faster RegExp:** The upcoming Bun release includes RegExp performance improvements measured at up to 281x faster, which matters for any parsing-heavy server-side JS workloads running on Bun. [Read more](https://daily.dev/posts/EjDDWe5Yd) - **Base UI v1.7.0 ships bundle size reductions and Safari/Firefox focus fixes:** Base UI v1.7.0 lands bug fixes across nearly all components — notably restoring visible keyboard focus after close in Safari and Firefox — plus popup and store bundle size reductions; worth pulling if you're using Drawer, Combobox, or Toast. [Read more](https://daily.dev/posts/AcRagbNRK) - **Promise.allKeyed() and .allSettledKeyed() reach TC39 stage 3:** The TC39 proposal for Promise.allKeyed() and Promise.allSettledKeyed() — which accept an object of promises and return results keyed by property name instead of positional array indices — is now at stage 3. [Read more](https://daily.dev/posts/ARtSYfJc8) - **Yelp migrated 1.4 million lines from Flow to TypeScript, type coverage went from 83% to 96%:** JavaScript Weekly issue #798 covers Yelp's Flow-to-TypeScript migration across 1.4 million lines of code, bringing type coverage from 83% to 96% — a useful reference point for teams still sitting on Flow. [Read more](https://daily.dev/posts/6k6z0UIdO) - **Mercure 1.0 alpha replaces URI Templates with WHATWG URL Pattern and aligns auth with OAuth 2.0:** Mercure 1.0 alpha rewrites topic matching to use the WHATWG URL Pattern standard, replaces custom auth with RFC 9068 OAuth 2.0 access tokens, and ships a compatibility mode (protocol_version_compatibility 8) so existing 0.x clients connect without changes. [Read more](https://daily.dev/posts/ZahpebKSL) ## Similar posts on daily.dev - [Strict TypeScript API, Metro Update, Swift Package Manager, AGP 9 Support · React Native](https://daily.dev/posts/strict-typescript-api-metro-update-swift-package-manager-agp-9-support-react-native-n4g0wm71v) · React Native · 56 upvotes · 4 comments - [RN 0.86, Enriched, Gesture Handler, Crypto, Morph View, Compressor, Data Detector, XCFrameworks Hermes](https://daily.dev/posts/rn-0-86-enriched-gesture-handler-crypto-morph-view-compressor-data-detector-xcframeworks-herm-flhzmadvh) · This Week In React · 14 upvotes · 1 comments - [JavaScript Weekly Issue 778: March 24, 2026](https://daily.dev/posts/javascript-weekly-issue-778-march-24-2026-ocevvfkzr) · JavaScript Weekly · 12 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#typescript](https://daily.dev/tags/typescript), [#react-native](https://daily.dev/tags/react-native), [#google-chrome](https://daily.dev/tags/google-chrome) [View this post on daily.dev](https://daily.dev/posts/737-malicious-vpn-extensions-hit-chrome-web-store-react-native-0-87-drops-strict-typescript-api-eyhkntdst) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/737-malicious-vpn-extensions-hit-chrome-web-store-react-native-0-87-drops-strict-typescript-api-eyhkntdst","headline":"737 malicious VPN extensions hit Chrome Web Store, React Native 0.87 drops strict TypeScript API","text":"Socket found 737 fake VPN extensions in the Chrome Web Store routing traffic through Russian-controlled proxies — 516 are still live. React Native 0.87 ships with the Strict TypeScript API as default and Metro getting 2x faster source maps. Chrome's Device Bound Session Credentials landed on macOS in Chrome 147, extending the Windows TPM support from Chrome 145. Linear migrated to StyleX after 1,000 PRs and saw ~30% faster in-app navigation.","url":"https://daily.dev/posts/737-malicious-vpn-extensions-hit-chrome-web-store-react-native-0-87-drops-strict-typescript-api-eyhkntdst","datePublished":"2026-08-12T04:18:39.909Z","dateModified":"2026-08-12T04:19:06.225Z","author":{"@type":"Organization","name":"Web Digest","logo":"https://media.daily.dev/image/upload/s--C833eNQW--/f_auto,q_auto/v1773839396/logos/webdev_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/webdev_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/webdev_digest","name":"Web Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Web Digest","item":"https://daily.dev/sources/webdev_digest"},{"@type":"ListItem","position":3,"name":"737 malicious VPN extensions hit Chrome Web Store, React Native 0.87 drops strict TypeScript API"}]} ```