--- title: Socket Threat Intel Now Shows Which Malware Campaigns... description: Socket's Threat Intel dashboard now shows whether each malware campaign was blocked or detected in your organization. Every campaign on the Threat Intel →... canonical: https://daily.dev/posts/socket-threat-intel-now-shows-which-malware-campaigns-were-blocked-or-detected-r7stjcjaj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected | daily.dev og:description: Socket's Threat Intel dashboard now shows whether each malware campaign was blocked or detected in your organization. Every campaign on the Threat Intel →... og:url: https://daily.dev/posts/socket-threat-intel-now-shows-which-malware-campaigns-were-blocked-or-detected-r7stjcjaj og:image: https://api.daily.dev/og/posts/r7STJCjAj.png og:image:alt: Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected **[Socket](https://daily.dev/sources/socketdev)** · 2 min read · 0 upvotes · 0 comments ## Summary Socket's Threat Intel dashboard now shows whether each malware campaign was blocked or detected in your organization. Every campaign on the Threat Intel → Campaigns page gets a real-time status: 'Blocked by Socket', 'Detected in Firewall/SCA', or 'Not Detected'. The summary draws from immutable full scans, diff scans on pull requests, and Firewall event traffic. The Org Impact tab lists affected repositories and branches, first and last seen dates, and links directly to the scan report or Firewall event, as shown with the keyv and cacheable campaign. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I tell if a malicious npm package campaign actually reached my organization? Socket Threat Intel now shows a real-time per-organization status for each malware campaign: Blocked by Socket, Detected in Firewall/SCA, or Not Detected. It pulls from immutable full scans of repositories, immutable diff scans on pull requests, and Socket Firewall event traffic, then links each detection to the specific scan report or Firewall event. _Teams tracking supply chain exposure can follow coverage of tools like this on daily.dev._ ### How does Socket show impact for malware campaigns that involve multiple packages, like the keyv and cacheable campaign? Socket's Org Impact tab lists each affected package and version separately, with its own block/detect status and first and last seen dates, plus links to the matching scan report or Firewall event. This lets teams see exactly which malicious versions of packages like keyv and cacheable were blocked and when they were first and last observed. _Anyone investigating a multi-package supply chain attack can keep up with these detection details on daily.dev._ ## Similar posts on daily.dev - [Socket Named a Supply Chain Innovator in Latio's 2026 Applic...](https://daily.dev/posts/socket-named-a-supply-chain-innovator-in-latio-s-2026-applic--13r2qcnvy) · Socket · 0 upvotes · 0 comments - [11th May – Threat Intelligence Report](https://daily.dev/posts/11th-may-threat-intelligence-report-i9rr1z4ua) · Check Point Research · 0 upvotes · 0 comments - [Socket Brings Supply Chain Security to skills.sh](https://daily.dev/posts/socket-brings-supply-chain-security-to-skills-sh-hdn0cjdox) · Socket · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/socket-threat-intel-now-shows-which-malware-campaigns-were-blocked-or-detected-r7stjcjaj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected","url":"https://daily.dev/posts/socket-threat-intel-now-shows-which-malware-campaigns-were-blocked-or-detected-r7stjcjaj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/socket-threat-intel-now-shows-which-malware-campaigns-were-blocked-or-detected-r7stjcjaj"},"datePublished":"2026-10-26T23:05:19.095Z","dateModified":"2026-10-29T16:08:54.776Z","description":"Socket's Threat Intel dashboard now shows whether each malware campaign was blocked or detected in your organization. Every campaign on the Threat Intel →...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0ef9ea6d14a07298610e9a6f2c1e55ea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0ef9ea6d14a07298610e9a6f2c1e55ea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/socket-threat-intel-now-shows-which-malware-campaigns-were-blocked-or-detected-r7stjcjaj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,npm,appsec","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/socket-threat-intel-now-shows-which-malware-campaigns-were-blocked-or-detected-r7stjcjaj#faq","mainEntity":[{"@type":"Question","name":"How can I tell if a malicious npm package campaign actually reached my organization?","acceptedAnswer":{"@type":"Answer","text":"Socket Threat Intel now shows a real-time per-organization status for each malware campaign: Blocked by Socket, Detected in Firewall/SCA, or Not Detected. It pulls from immutable full scans of repositories, immutable diff scans on pull requests, and Socket Firewall event traffic, then links each detection to the specific scan report or Firewall event. Teams tracking supply chain exposure can follow coverage of tools like this on daily.dev."}},{"@type":"Question","name":"How does Socket show impact for malware campaigns that involve multiple packages, like the keyv and cacheable campaign?","acceptedAnswer":{"@type":"Answer","text":"Socket's Org Impact tab lists each affected package and version separately, with its own block/detect status and first and last seen dates, plus links to the matching scan report or Firewall event. This lets teams see exactly which malicious versions of packages like keyv and cacheable were blocked and when they were first and last observed. Anyone investigating a multi-package supply chain attack can keep up with these detection details on daily.dev."}}]} ```