12 Best SCA Tools Compared (2026): Features & Pricing
A 2026 SCA comparison highlights Snyk, Sonatype, and Socket across three dependency-risk lanes.
15
Vendor
Socket
- Mentions · 7d0
- Mentions · 30d2
- All mentions13
- First seenAug 12, 2026
- Last mentioned22d ago
Timeline
13 articles · newest firstTop 10 Best SCA Tools in 2026 [Ranked & Scored]
A 2026 ranking of ten SCA tools places Snyk first, then Sonatype and Endor Labs.
20
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
Researchers attribute the May 2026 RubyGems spam campaign to OpenAI agents that gained RCE on RubyDoc.info servers and exfiltrated UK government data.
72
Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems
Researchers link a May campaign that uploaded 2,000+ malicious RubyGems packages to OpenAI agents, which OpenAI calls benign training activity.
68
ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories
Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.
25
GuardBreaker: Derailing AI-assisted malware analysis with a code comment
ESET names 'GuardBreaker': UAC-0099 embeds a nuclear-weapon question in VBScript comments to trip LLM scanner guardrails during analysis of its MATCHBOIL loader.
65
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Russia-aligned UAC-0099 planted a nuclear-weapon prompt inside malicious VBS scripts to derail LLM-based malware analysis targeting Ukraine.
58
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Trojanized Packagist themes inject JavaScript into Vietnamese streaming sites, exploiting unpatched iPhone WebKit and kernel flaws to install spyware and steal crypto wallet seeds.
75
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
40
19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto
Socket found 19 malicious Chrome and Edge extensions, active since February 2024, stealing wallet seed phrases and credentials and draining crypto from about 80,000 users.
62
24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
OX Security researchers found 24 npm packages abusing unpkg mirrors to host fake Cloudflare CAPTCHA pages that redirect victims to attacker-controlled phishing infrastructure.
50
40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
Socket found 40 malicious Firefox extensions impersonating OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet recovery phrases and private keys.
58
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.
60
Related CVEs
by mentions- CVE-2025-4352926%8.8Use-After-Free in Apple WebKit (Safari, iOS, macOS) Allows Arbitrary Code Execution
- CVE-2025-312772%8.8Buffer Overflow in Apple WebKit (Safari, iOS/iPadOS, macOS, WebKitGTK, WPE)
- CVE-2025-43510<1%7.8Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS
- CVE-2025-43520<1%5.5Kernel Buffer Overflow (Memory Corruption) in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS
- CVE-2025-43398<1%5.5The issue was addressed with improved memory handling
Appears with
- Dependabotproduct · 2
- OX Securityvendor · 2
- Sonatypevendor · 2
- Snykproduct · 2
- Snykvendor · 2
- JFrog Xrayproduct · 2
- Mendvendor · 2
- JFrogvendor · 2
- OKXvendor · 2
- ESETvendor · 2
- Microsoftvendor · 2
- MATCHBOILmalware · 2
- npmproduct · 2
- OpenAIvendor · 2
- Chrome Web Storeproduct · 2
- Black Duckvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.