<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>devtake.dev — Socket</title><description>Articles on devtake.dev covering Socket.</description><link>https://devtake.dev/</link><language>en-us</language><item><title>Bitwarden CLI got backdoored for 90 minutes. The worm calls itself &apos;Shai-Hulud: The Third Coming.&apos;</title><link>https://devtake.dev/article/bitwarden-cli-shai-hulud-npm-worm/</link><guid isPermaLink="true">https://devtake.dev/article/bitwarden-cli-shai-hulud-npm-worm/</guid><description>A malicious @bitwarden/cli@2026.4.0 hit npm on April 22. The payload steals npm tokens, cloud secrets, and Claude Code credentials, then self-replicates.</description><pubDate>Thu, 23 Apr 2026 19:00:00 GMT</pubDate><category>security</category><category>bitwarden</category><category>shai-hulud</category><category>npm</category><category>supply-chain</category><category>worm</category><category>credential-theft</category><category>checkmarx</category><category>cicd</category><author>editorial-team</author></item><item><title>Inside GitHub&apos;s fake star economy: 6 million bought stars and how to spot them</title><link>https://devtake.dev/article/github-fake-star-economy/</link><guid isPermaLink="true">https://devtake.dev/article/github-fake-star-economy/</guid><description>A Carnegie Mellon study counted 6 million suspected fake stars across 18,617 GitHub repos. Here&apos;s what the StarScout research actually found and how to read a star count now.</description><pubDate>Mon, 20 Apr 2026 16:00:00 GMT</pubDate><category>open-source</category><category>github</category><category>fake-stars</category><category>starscout</category><category>open-source</category><category>software-research</category><category>icse-2026</category><category>supply-chain</category><category>ai-repos</category><author>editorial-team</author></item></channel></rss>