--- title: Best Socket posts — February 2026 | daily.dev description: The most upvoted Socket posts from February 2026, curated by the daily.dev community. canonical: https://daily.dev/sources/socketdev/best-of/2026/02 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/sources/socketdev/best-of/2026/02 og:type: website og:site_name: daily.dev og:title: Best Socket posts — February 2026 | daily.dev og:description: The most upvoted Socket posts from February 2026, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of Socket — February 2026 1. 1 [](https://daily.dev/posts/socket-joins-the-openjs-foundation-6q2np6xr7 "Socket Joins the OpenJS Foundation") Article Socket · 28w Socket Joins the OpenJS Foundation Socket, a JavaScript supply chain security company, has joined the OpenJS Foundation as a Silver Member. The company highlights its deep roots in the JavaScript open source community, noting that its engineers collectively maintain packages accounting for roughly 10% of all npm downloads. The membership reinforces Socket's commitment to improving security and governance of the JavaScript ecosystem, with goals around making the open source supply chain safer and more resilient. 65 3 2. 2 [](https://daily.dev/posts/malicious-go-crypto-module-steals-passwords-and-deploys-re--hubou1zfx "Malicious Go “crypto” Module Steals Passwords and Deploys Re...") Article Socket · 27w Malicious Go “crypto” Module Steals Passwords and Deploys Re... Socket's Threat Research Team discovered a malicious Go module, github.com/xinfeisoft/crypto, impersonating the legitimate golang.org/x/crypto package. The backdoor was inserted into ssh/terminal/terminal.go's ReadPassword function, which captures passwords, exfiltrates them to attacker-controlled infrastructure, and executes a remote shell stager. The stager adds an SSH key for persistence, weakens iptables firewall rules, and downloads two disguised payloads — one of which is confirmed as the Rekoobe Linux backdoor linked to APT31\. The module used GitHub Raw as a rotating C2 pointer to avoid republishing. The Go module proxy now blocks the package with a 403 SECURITY ERROR after Socket's report. Defenders are advised to treat go.mod changes as security-sensitive, use dependency scanning in CI, and watch for curl|sh execution, authorized\_keys modifications, and iptables policy changes. 59 2 3. 3 [](https://daily.dev/posts/introducing-php-and-composer-support-in-socket-u5uczrhng "Introducing PHP and Composer Support in Socket") Article Socket · 29w Introducing PHP and Composer Support in Socket Socket now supports PHP and Composer, offering package search, SBOM generation, and supply chain security protection for PHP dependencies. The platform provides AI-powered analysis to detect zero-day threats, typosquatting, and backdoors beyond traditional CVE scanning. Key features include lockfile analysis, dev dependency tracking, vulnerability detection with CISA KEV enrichment, and proactive Packagist monitoring. Package search is available now for everyone, while SBOM generation and full security scanning are rolling out experimentally to customers. 41 [See all Socket archives](/sources/socketdev/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/sources/socketdev/best-of/2026/02#page","url":"https://daily.dev/sources/socketdev/best-of/2026/02","name":"Best Socket Posts — February 2026","description":"The most upvoted Socket posts from February 2026, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/sources/socketdev/best-of/2026/02#items","numberOfItems":3,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/socket-joins-the-openjs-foundation-6q2np6xr7","name":"Socket Joins the OpenJS Foundation"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/malicious-go-crypto-module-steals-passwords-and-deploys-re--hubou1zfx","name":"Malicious Go “crypto” Module Steals Passwords and Deploys Re..."},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/introducing-php-and-composer-support-in-socket-u5uczrhng","name":"Introducing PHP and Composer Support in Socket"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sources","item":"https://daily.dev/sources"},{"@type":"ListItem","position":3,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/sources/socketdev/best-of"},{"@type":"ListItem","position":5,"name":"February 2026"}]}]} ```