Socket @SocketSecurity Twitter profile

Pinned Tweet

Socket

@SocketSecurity

1 year

🚀

Feross

@feross

1 year

🚀 Huge news! @SocketSecurity has raised $20M Series A funding led by Andreessen Horowitz ( @a16z ). ⭐️ This funding fuels our mission to make open source safer for everyone! 🚀🚀🚀 We're also announcing 4 new products this week as part of Socket Launch Week! ✨ 🧵 1/10

58

71

610

6

2

14

Last Seen Profiles

@fiodo0205

@bokeplokalmalam

@uw_ece

@annelavaud

@reemdxbb

@cnncert

@lenalinoo

@Il1lI1VvKGwdKhl

@DoblatgeCatala

@uarmyvante

@EricOnyechefule

@aritros1

@GariiHadi

@Motor1com

@CemilUgural

@dreamyfool

@skintight_geek

@Tante_Binal69

@minelachina

@MaxAdelmanMD

@kaijyunopapa

@Abraham6264

@4mt1653410y

@valdaikiss

@forestofbowland

@joojmoreno

@borasqueen

@NEHE_KAYODE

@IGFGolf

@cukienaknikmati

@stw_pdg

@coop3rdavis

@Tante_Binal69

@qPpHr4EAFUlOIRh

@Aliarslan_17

@stevenslukas1

Socket

@SocketSecurity

1 year

6

14

97

Socket

@SocketSecurity

2 years

"I can solve this with a simple npm package." 179 transitive dependencies and 240 MB of JavaScript later...

7

9

72

Socket

@SocketSecurity

1 year

@kentcdodds Consider using @SocketSecurity to catch these types of issues. Specifically, you can install "safe npm" to warn you before you make typos like this:

Introducing "safe npm", a Socket npm Wrapper - Socket

Socket is proud to introduce an exciting new tool—“safe npm”—that protects developers whenever they use npm install.

socket.dev

2

3

68

Socket

@SocketSecurity

6 months

Redis is no longer #OSS , breaking its explicit commitment to remain under the BSD 3-Clause License forever. This has angered contributors who are now working to fork the software.

Redis License Shift Splits Community: Open Source Contributors Move to Fork - Socket

Redis is no longer OSS, breaking its explicit commitment to remain under the BSD 3-Clause License forever. This has angered contributors who are now w...

socket.dev

1

16

60

Socket

@SocketSecurity

1 year

We saw some interest in path aliases from a few community tools and things lately on social media so we made a little blog post to explain how they can be done in a less tool specific manner for JS/TS! Hope this helps those who are looking to learn.

Cleaning up import paths in JS/TS packages - Socket

package.json contains a local aliasing mechanism for import paths called "imports" it satisfies many use cases without tooling specific solutions like...

socket.dev

2

16

41

Socket

@SocketSecurity

7 months

Big news: The @deno_land team announced @jsr_io , the new package registry, is now in public beta: "With the emergence of Deno, Bun, and other new #JavaScript environments, a Node-centric package registry no longer makes sense for the entire JS ecosystem."

JSR Now in Public Beta, Aims to Shift Community Towards Using ESM Modules - Socket

JSR, the new JavaScript registry, is now in public beta, designed for TypeScript and ESM.

socket.dev

0

6

42

Socket

@SocketSecurity

7 months

If you haven't been following, there's a new JavaScript package registry in town. JSR, created by the @deno_land team, is still in the early stages. Here are some initial impressions and reactions from developers across the #JavaScript ecosystem:

JSR: What We Know So Far About Deno’s New JavaScript Package Registry - Socket

JSR, a new package registry from the Deno team, aims to address npm’s limitations but the JavaScript community is concerned about ecosystem fragmentat...

socket.dev

1

12

40

Socket

@SocketSecurity

2 years

Socket is now available in the GitHub Marketplace! Install Socket and get protected today!

2

5

29

Socket

@SocketSecurity

2 years

🤖 Introducing Socket AI – ChatGPT-Powered Threat Analysis

Feross

@feross

2 years

✨ HUGE NEWS! ✨ 🤖 Introducing Socket AI – ChatGPT-Powered Threat Analysis @SocketSecurity is using ChatGPT to examine every npm and PyPI package for security issues! 🤯 In just 2 days, we confirmed 227 vulnerable and malware packages, all discovered with the help of ChatGPT

34

222

1K

0

5

25

Socket

@SocketSecurity

3 years

👋 Hello everyone! We're the company behind Wormhole ( @Wormhole_App ) at ! Follow us here to be the first to hear about our newest product – launching soon! ✨

1

2

22

Socket

@SocketSecurity

2 years

1

2

24

Socket

@SocketSecurity

7 months

Node.js TSC Confirms: No Intention to Remove npm from Distribution

Node.js TSC Confirms: No Intention to Remove npm from Distribution - Socket

The Node.js Technical Steering Committee has confirmed that removing npm from the Node.js distribution is not a project goal, amidst continued discuss...

socket.dev

3

7

20

Socket

@SocketSecurity

3 years

Socket was featured in @TheRegister today: "This JavaScript scanner hunts down malware in libraries"

0

7

19

Socket

@SocketSecurity

2 years

We're thrilled to share that Socket has joined the Open Source Security Foundation ( @theopenssf ) But why did we join? tldr: 💪 Open source has won. 🔒 But security has often been an afterthought Thread 🧵⬇️

Why Socket Joined the Open Source Security Foundation - Socket

Socket is joining the Open Source Security Foundation (OpenSSF), the cross-industry organization working on the most important open source security in...

socket.dev

1

4

20

Socket

@SocketSecurity

1 year

We started Socket with a simple but audacious goal: to safeguard the open source ecosystem for everyone. Today, that dream is a bit brighter—literally! Our logo is lighting up Times Square! A heartfelt thanks to our passionate team, our brave customers, and everyone who has

1

3

19

Socket

@SocketSecurity

6 months

Today, we are excited to introduce dependency visualization for reports - get a quick impression of the state of your dependencies without getting lost in the details.

2

6

18

Socket

@SocketSecurity

6 months

🚨 Urgent security alert: Backdoor found in widely used Linux utility - here's how to use Socket to find out if you were affected:

How to Use Socket to Find out if You Were Affected by the Backdoored xz Package - Socket

XZ utils, a package for data compression software used in nearly every Linux distribution, was found to be backdoored and may allow unauthorized acces...

socket.dev

0

8

18

Socket

@SocketSecurity

2 years

Socket for GitHub is officially 1.0! 🎉

Feross

@feross

2 years

Today we're excited to announce the 1.0 release of @SocketSecurity for GitHub – we're finally out of beta! 🎉 We're shipping a big update to Socket for GitHub to help developers protect their apps from software supply chain attacks. 💪 Thread 🧵⬇️

1

23

104

5

2

18

Socket

@SocketSecurity

2 years

Another week, another npm supply chain attack 😢 If you haven't read our post "What's Really Going On Inside Your node_modules Folder?", don't miss it. It's a must read.

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.

socket.dev

1

6

17

Socket

@SocketSecurity

1 year

We are super excited about the new release of npm provenance by GitHub and delve into what it means in a new blog post!

npm Registry Code Signing - Socket

Socket explains the newly released npm provenance provided by GitHub.

socket.dev

0

6

16

Socket

@SocketSecurity

9 months

✨ New Year, New npm Insights! ✨ 📈 npm's 2023 wrap-up: 2.5M+ live packages, 33B+ weekly downloads 🛡️ Security Spotlight: Socket reported 5K+ malware packages 📦 Biggest npm package: a hefty 5.96 GB! Dive into some fascinating npm stats with us:

npm in Review: A 2023 Retrospective on Growth, Security, and Quirky Facts - Socket

From unprecedented expansion to security challenges: A comprehensive look at npm's dynamic year 2024.

socket.dev

1

8

15

Socket

@SocketSecurity

10 months

Socket CLI v0.9.0 Now Available! We updated the socket info command so you can get useful information about an npm package, right in the terminal: 📦 View package scores 🚨 View package issues 🔎 Use dist tags Read more:

1

3

14

Socket

@SocketSecurity

2 years

Socket is proud to announce that we’ve received a clean SOC 2 Type 1 attestation report. Read this thread to learn: ⭐️ How does Socket put security first? ⭐️ What is a SOC 2 audit? ⭐️ Why does SOC 2 compliance matter? 🧵 See thread ⬇️⬇️⬇️

Announcing SOC 2 Type 1 Compliance - Socket

Socket has successfully completed the SOC 2 Type I audit by meeting rigorous security and confidentiality standards.

socket.dev

1

2

13

Socket

@SocketSecurity

2 years

@mikemaccana ✅ Socket analyzes the *behavior* of a package to catch install scripts, obfuscated code, privileged APIs such as shell, network, filesystem, and environment variables. ❌ Snyk compares your dependency list to a list of known vulnerabilities and tells you if there's a match.

4

3

13

Socket

@SocketSecurity

1 year

1. 🚨 Alert! The 'Skeleton Squad' is now targeting NPM! Our research team at Socket has discovered a new threat to the JavaScript ecosystem, and specifically, the npm package manager. 😱

1

4

13

Socket

@SocketSecurity

7 months

📦 Some interesting discussions are happening around @openjsf new effort to iterate on the informal standardization of package.json and improve the interoperability of #JavaScript package metadata for application developers:

OpenJS Launches New Collaboration to Improve Interoperability of JavaScript Package Metadata -...

The OpenJS Foundation has launched a new effort to iterate on the informal standardization of package.json and improve the interoperability of JavaScr...

socket.dev

0

5

11

Socket

@SocketSecurity

2 years

Very nice work from the @npmjs team here! Maintainers of the top 500 npm packages, by dependents, must use Two-Factored Authentication (2FA).

Top-500 npm package maintainers now require 2FA · GitHub Changelog

Top-500 npm package maintainers now require 2FA

github.blog

1

3

11

Socket

@SocketSecurity

6 months

🚨 A Socket investigation has uncovered an npm package for a React components library that exfiltrates sensitive developer information, including your operating system username, Git username, and Git email. #reactjs #extjs

npm Package for ReExt React Components Library Exfiltrates Git Credentials - Socket

The Socket Research team found this npm package includes code for collecting sensitive developer information, including your operating system username...

socket.dev

0

8

11

Socket

@SocketSecurity

2 years

We're honored that @GitHub interviewed @feross (founder and CEO of Socket) to discuss how he got started in open source, what he learned along the way, and why the software supply chain needs protecting with .

GitHub

@github

2 years

Every time @feross sees something missing from open source, he tries to build it, contributing “lego blocks” for others to use and create whatever they can dream up.

4

13

80

0

3

11

Socket

@SocketSecurity

2 years

On average, a malicious package is available for 209 days before being publicly reported

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.

socket.dev

0

6

11

Socket

@SocketSecurity

2 years

🎉 Introducing Socket Security Bot Commands! 🎉 👍 Ignore Socket PR alerts that you deem acceptable 🙋‍♀️ Quit bugging your org admins. By ignoring issues, you can make your branch protections pass. 👀 See more in our blogpost and give it a try!

Introducing Bot Commands - Socket

Dismiss Socket pull request alerts using bot commands.

socket.dev

1

3

11

Socket

@SocketSecurity

9 months

Reporting passwords stored in plain text can land you a €3,000+ fine or up to 3 years in a German prison: #ethicalhacking #hacking #cybersecurity

Ethical Hacking on Trial: German Court Fines Security Researcher for Reporting a Company's Data...

A German court's controversial ruling fined a security researcher for exposing a company's data vulnerabilities, sparking intense debate over the futu...

socket.dev

1

7

10

Socket

@SocketSecurity

5 months

LDAPjs, an LDAP client and server API for Node.js, was decommissioned after its maintainer received an abusive email from a user, raising concerns about this form of abuse as a potential attack vector. #nodejs #JavaScript #opensource

LDAPjs Open Source Project Decommissioned After Maintainer Receives Abusive Email - Socket

LDAPjs, an LDAP Client and Server API for Node.js, was decommissioned after its maintainer received an abusive email from a user, raising concerns abo...

socket.dev

0

3

10

Socket

@SocketSecurity

7 months

GitHub detected 1 million+ leaked secrets in the first 8 weeks of 2024. Push protection is now on by default for all user accounts. This is a major step towards reducing the overall number of leaked secrets available to threat actors. @github

GitHub Activates Push Protection by Default After Detecting Over 1 Million Leaked Secrets in Public...

GitHub has enabled push protection by default for all user accounts. This feature prevents accidental leaks of API keys, tokens, and other secrets, a ...

socket.dev

0

9

Socket

@SocketSecurity

2 years

Users of Socket are protected from attacks like the recent npm "logic flaw" (see below) Socket analyzes the ✨ package content ✨ of every npm package in your app to detect typosquat attacks and risky packages. Try it in 2 minutes:

The Hacker News

@TheHackersNews

2 years

A "logical flaw" has been disclosed in the #NPM package manager that allowed attackers to pass off malicious libraries as legitimate by adding notable developers as contributors without their knowledge, tricking unsuspecting devs into installing them.

2

44

83

0

3

10

Socket

@SocketSecurity

2 years

Add the Socket wrapper to "npm" and "npx" and protect your machine from insecure + low quality packages! ✅ Warns you before running install scripts ✅ Warns you when you typo a package name ✅ Takes just 30 seconds to set up! 🚀 Get it here:

0

2

10

Socket

@SocketSecurity

1 year

Don't let this be you. Use

1

2

9

Socket

@SocketSecurity

1 year

We are excited to share some feedback updates about `socket npm` and what we are seeing it is being used for, what issues people are having, and what features they are wanting in the future!

Socket npm Wrapper Feedback Update - Socket

We share some feedback and directions on Socket's npm wrapper.

socket.dev

0

3

9

Socket

@SocketSecurity

2 years

Security tooling should be simple and provide ways to help before investing time into big code commitments. The new VS Code editor extension allows our first step into expanding when Socket can help in your dev workflow.

Socket VSCode Extension - Socket

Introducing a VS Code editor integration for Socket Security.

socket.dev

0

3

9

Socket

@SocketSecurity

1 year

It’s our first time sponsoring a conference as a company. We couldn’t be happier that we chose @BSidesSF as our first! ❤️

BSidesSF CTF

@BSidesSFCTF

1 year

Thank you @SocketSecurity for sponsoring this year's CTF!

0

3

4

0

2

9

Socket

@SocketSecurity

10 months

🧙‍♂️ A fun interview with @feross , our founder & CEO:

Meet the talent: Feross Aboukhadijeh, Founder and CEO of Socket

I'm laser-focused on growing Socket right now. Socket helps developers and security teams to ship faster and spend less time on security busywork.

4imag.com

1

4

8

Socket

@SocketSecurity

6 months

🚀 Since launching, Socket AI has scanned hundreds of thousands of packages, uncovering tens of thousands of new vulnerabilities, anomalies, and malware instances. After a year of refining our system and processes, we're excited to update the default AI settings.

1

2

8

Socket

@SocketSecurity

6 months

“Anyone who suggests this was any kind of success is a fool. No system caught this, it was luck and individual heroics. That's not acceptable when unauthorized access to ~every server on the internet is on the table.” - @damienmiller

Software Supply Chain Compromise Now the Top Threat of the Next Half Decade - Socket

ENISA has identified software supply chain attacks as the top cybersecurity threat for the next five years, just prior to the accidental discovery of ...

socket.dev

0

4

8

Socket

@SocketSecurity

11 months

People are looking at different package managers which means different versions (and security potentially) can get installed in addition different performance! We made a GH action to expose these perf and version differences!

Introducing Dependency Divergence GitHub Action - Socket

Socket discusses the results of using different package managers to install your packages and introduces a GitHub action to expose those differences.

socket.dev

1

4

8

Socket

@SocketSecurity

2 years

🎊 Introducing customizable issue alerts 🎊 🎛️ Enable or disable Socket Pull Request alerts 📈 Access 70+ customizable alert types in Pull Request reports

Customize your GitHub Issue Alerts - Socket

Socket for GitHub has added the option to customize which issue alerts your pull request receives.

socket.dev

2

4

7

Socket

@SocketSecurity

9 months

📃Check out the latest extensive resource from @bradleymeck on our blog exploring the nuances and best practices of using JSON. Take a deep dive into advanced concepts, standards, and practical insights to elevate your JSON game:

Judicious JSON - Socket

JSON is a simple technology but has a lot of underlying topics to think about. This guide can help uncover those topics.

socket.dev

2

3

8

Socket

@SocketSecurity

6 months

OSI is starting a conversation aimed at removing the excuse of the "SaaS loophole" for companies navigating licensing and the complexities of doing business with open source. @OpenSourceOrg

OSI to Lead Discussions on Navigating the Challenges of Doing Business with Open Source - Socket

OSI is starting a conversation aimed at removing the excuse of the SaaS loophole for companies navigating licensing and the complexities of doing busi...

socket.dev

2

8

Socket

@SocketSecurity

2 years

We have been using GPT3 in production for a few months now! Here is a brief writeup of the experience we are seeing using it. Amazing stuff; hopefully we will start seeing more ways it can help in the future.

Using GPT at Work - Socket

We have been using GPT at Socket to help triage the npm package firehose for a couple months now. Here is what it is like after actual experience.

socket.dev

0

4

8

Socket

@SocketSecurity

1 year

1/5 🚨 Security Update: Did you know your #npm packages could be under threat from a security risk called "manifest confusion"? Huge shoutout to @darcy for bringing this critical issue into the spotlight! #Cybersecurity

1

6

8

Socket

@SocketSecurity

10 months

🚀 We’re pleased to introduce our new Audit Log feature today, which allows administrators to track important account changes: 🔍 Get comprehensive details and context on events ⏱️ Save time in debugging 📤 Easily export records in CSV and JSON formats

Introducing Audit Logs for Security and Compliance - Socket

Socket's new Audit Log feature allows administrators to monitor important account changes and the history of all events in Socket.

socket.dev

0

3

8

Socket

@SocketSecurity

8 months

🚨 In a massive international operation, authorities have dismantled LockBit, the world's largest ransomware gang. Security researchers claim authorities compromised #LockBit through an unpatched #PHP vulnerability. Details on this historic takedown:

LockBit Takedown: U.S. Sanctions Ransomware Affiliates, International Law Enforcement Seizes...

International law enforcement organizations have disrupted LockBit, the world’s largest ransomeware gang, seized their operations and infrastructure, ...

socket.dev

0

2

8

Socket

@SocketSecurity

2 years

Watching all the data you get in a full security report can be overwhelming or time consuming. We are pushing forward on a more usable experience for this with Project Health Reports!

Announcing Socket Project Health Reports - Socket

Socket introduces an overall project health report for viewing relevant data to entire projects at a glance.

socket.dev

1

4

8

Socket

@SocketSecurity

8 months

🚨 Alert to #Roblox developers: The Socket research team took a deep dive into a malicious npm package we flagged, which is masquerading as Noblox.js. It targets Roblox users for data theft. Read our full analysis on the blog:

Malicious npm Package Masquerades as Noblox.js, Targeting Roblox Users for Data Theft - Socket

A malicious npm package is targeting Roblox's massive user base to steal sensitive data, with potential impacts for both players and developers on the...

socket.dev

1

4

8

Socket

@SocketSecurity

9 months

☃️ It’s snowing on our website! As you enjoy the festive season, we’re here to keep your packages safe and sound. Happy holidays from our team to yours! (P.S. There’s a grinch mode: Go to your Profile Settings to turn it off.) ❄️❄️❄️

Socket - Secure your dependencies. Ship with confidence.

Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript, Python, and Go dependencies.

socket.dev

0

1

8

Socket

@SocketSecurity

6 months

What does a software supply chain attack look like? Check out @feross ' talk at @NodeCongress on the Dark Side of Open Source. If you enjoy digging into examples of malicious code, this is a fun video!

The Dark Side of Open Source - Socket

At Node Congress, Socket CEO Feross Aboukhadijeh uncovers the darker aspects of open source, where applications that rely heavily on third-party depen...

socket.dev

0

5

7

Socket

@SocketSecurity

2 years

The Socket team is at @BSidesSF - send us a DM if you want to meet up to chat, learn more about Socket, or see a demo!

0

2

7

Socket

@SocketSecurity

2 years

@mikemaccana Supply chain attacks and vulnerabilities are very different, and they need very different solutions. Socket is built with a very different assumption: What if we assume all open source packages may be malicious and work backwards from there?

1

7

Socket

@SocketSecurity

2 years

Have you ever had some odd issues with RegExp in JS due to strings being split up into pieces? We are looking into how to make RegExp work better with one of JS' biggest design patterns, streaming/chunked data!

Let's make JS RegExps Streamy - Socket

Proposing a more usable RegExp for JS in light of async I/O and streaming.

socket.dev

0

1

7

Socket

@SocketSecurity

9 months

🚨 From the Socket Research Team: We detected a malicious Python package using the open source Blank Grabber malware to steal data from applications like Discord and Telegram

Silent Discord Raider: 'Blank Grabber’ Python Package Steals Info from Discord and Telegram - Socket

Socket's research team detected and analyzed a new Python package that distributes Blank Grabber malware for stealing data from applications like Disc...

socket.dev

2

1

7

Socket

@SocketSecurity

10 months

ALPHV/Blackcat Ransomware Group Fires Back with Escalated Hostility, Following FBI’s Release of New Decryption Tool More details:

ALPHV/Blackcat Ransomware Group Fires Back with Escalated Hostility, Following FBI’s Release of New...

The ALPHV/Blackcat ransomware group has responded to the FBI's disruption of their operations with increased hostility, following the release of a dec...

socket.dev

0

5

7

Socket

@SocketSecurity

9 months

Today on the blog: A short history of protestware - from punch cards to package managers - we'll explore the intriguing and controversial phenomenon of digital activism and the risks to open source supply chains.

A Short History of Protestware - Socket

This short history of protestware - from punch cards to package managers - explores the intriguing and controversial phenomenon of digital activism an...

socket.dev

0

4

7

Socket

@SocketSecurity

9 months

Looks like we’re off to an interesting start in 2024! Today’s hijinks: a troll campaign that comes in the form of an npm package named ‘everything.’ It creates millions of transitive dependencies, exhausting storage space and resources:

When "Everything" Becomes Too Much: The npm Package Chaos of 2024 - Socket

An NPM user named PatrickJS launched a troll campaign with a package called "everything," which depends on all public npm packages.

socket.dev

0

4

7

Socket

@SocketSecurity

1 year

5/5 The discovery by @darcy underscores the importance of accurate dev & security tools. Read @darcy 's post for more about the massive bug at the heart of the npm ecosystem:

The massive bug at the heart of the npm ecosystem

An article detailing the massive bug at the heart of the npm ecosystem; encompassing a lack of validation by the public registry, package manifest inconsistancies & assumptions about package managers...

blog.vlt.sh

1

3

7

Socket

@SocketSecurity

1 year

2/5 The issue stems from an npm package's manifest being published separately from its tarball, with no full validation between the two. This can allow bad actors to sneak in hidden malware & scripts! 😱 Read more here:

Manifest Confusion: How Socket Protects You - Socket

Socket has been protecting organizations from "manifest confusion" attacks for 9 months before it was publicly disclosed.

socket.dev

1

4

7

Socket

@SocketSecurity

10 months

🚀 Big Update from Socket today! Introducing our new Organization Alerts, a highly requested feature that offers a comprehensive view of all risks across your organization’s repositories – even if you have hundreds of thousands of dependencies across thousands of repositories!

2

7

Socket

@SocketSecurity

2 years

Follow us on Mastodon! @SocketSecurity @fosstodon .org

Socket (@[email protected])

255 Posts, 25 Following, 115 Followers · Secure your JavaScript supply chain. Depend on Socket to protect your app from malicious dependencies lurking in your open source supply chain.

fosstodon.org

0

2

7

Socket

@SocketSecurity

7 months

Socket CEO @feross was interviewed by the @daytonaio team on the challenges developers face when selecting open source packages for their projects and how Socket is working to create a more secure ecosystem. Check out the interview here:

Daytona.io

@daytonaio

7 months

Open-source security is paramount. The CEO of @SocketSecurity , @feross , shares with Daytona insights on the proactive approach Socket takes to help developers and security teams navigate the complexities of open-source software. Check it out in the comments! #OpenSource #Security

1

6

11

0

1

7

Socket

@SocketSecurity

2 years

Learn about supply chain attacks from this excellent thread ⬇️

Enrique Benitez

@bntzio

2 years

What are supply chain attacks? ☠️⛓️ Why is it crucial to know and understand them when it comes to building software? I'll explain it to you in simple terms 🧵

1

8

18

1

2

6

Socket

@SocketSecurity

8 months

The #Node community is wrestling with the decision to enable Corepack by default, which has sparked a debate about the potential of removing npm from the Node.js binary. Here's an overview of the diverse opinions on this contentious matter: #nodejs

Node.js Community Debate Intensifies Over Enabling Corepack by Default and Potentially Unbundling...

The Node community is wrestling with the decision to enable Corepack by default, which has sparked a debate about the potential of removing npm from t...

socket.dev

0

1

7

Socket

@SocketSecurity

5 months

The seemingly innocuous events surrounding the XZ-utils attack - complaints about bugs, contributor offers, maintainer changes - regular open source stuff - were precisely what made it so difficult to detect.

0

7

Socket

@SocketSecurity

1 year

📰 You can subscribe to our blog with your favorite RSS reader now! 🧐

Subscribe to the Socket Blog - Socket

The Socket blog now offers both full content Atom and JSON feeds which let you subscribe to all future Socket blog posts.

socket.dev

0

2

6

Socket

@SocketSecurity

2 years

The Socket team is in Las Vegas for @AWSreInvent ✨ Send us a DM if you want to chat about open source, software supply chain, or see a demo of @SocketSecurity !

0

1

7

Socket

@SocketSecurity

7 months

We’re proud to share that we have successfully renewed our SOC 2 Type 2 unqualified opinion attestation for the next 12 months. This audit report is a third-party industry validation that Socket provides enterprise-level security for our customers’ data.

1

0

6

Socket

@SocketSecurity

7 months

Socket CEO @feross was interviewed by @basarat for his @NodeCongress Speaker Showcase series. Check out this fun conversation about #NodeJS and the challenges of securing open source dependencies.

Node Congress Speaker Showcase: Interview with Feross Aboukhadijeh - Socket

Socket CEO Feross Aboukhadijeh was recently interviewed on Basarat Ali Syed’s YouTube channel ahead of this year's Node Congress event. They discussed...

socket.dev

0

4

5

Socket

@SocketSecurity

1 year

At Socket, we're committed to fighting vulnerabilities & protecting your supply chain. Install us from the GitHub Marketplace today and get protected from #ManifestConfusion . Install it here in 2 clicks!

GitHub

GitHub is where people build software. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects.

github.com

0

4

6

Socket

@SocketSecurity

5 months

GitHub is susceptible to a CDN flaw that allows attackers to host malware in the file storage for any public repository.

How Threat Actors are Abusing GitHub’s File Upload Feature to Host Malware - Socket

GitHub is susceptible to a CDN flaw that allows attackers to host malware on any public repository.

socket.dev

0

4

6

Socket

@SocketSecurity

7 months

🚨 The Socket Research team has uncovered a malicious npm package targeting #Ethereum developers using #Hardhat tools in their development environments:

Malicious npm Package Targets Ethereum Developers, Masquerading as a Hardhat Development Tool -...

The "hardhat-gas-optimizer" npm package was found to exfiltrate sensitive data to Pastebin, targeting Ethereum developers using Hardhat tools in their...

socket.dev

1

5

Socket

@SocketSecurity

7 months

In case you missed it last week, we formalized our program to support open source projects. Get in touch with your GitHub organization name and we will upgrade you to our Team plan for free: #opensource #oss

Socket Introduces Free Team Plan Upgrades for Open Source Projects - Socket

In an effort to give back to the software creators whose contributions benefit the global developer community, open source projects can now get a free...

socket.dev

0

3

5

Socket

@SocketSecurity

1 year

Love the Socket sticker

Ethan Arrowood

@ArrowoodTech

1 year

Stickered my laptop 🎉

2

1

16

2

0

3

Socket

@SocketSecurity

7 months

Looks like LockBit's back in business, resurfacing with an attack on a pharmaceutical company, a $4M ransom demand, and a recommendation for a hairstylist in Colorado:

LockBit Resurfaces with Attack on Pharmaceutical Company, Leader Vows to “Continue Working Until...

LockBit, defying law enforcement takedowns, launches a new attack on Crinetics Pharmaceuticals, with the group's leader declaring a commitment to cont...

socket.dev

1

2

6

Socket

@SocketSecurity

1 year

4/5 We've upped our game with a new proactive detection against this technique. If any of your dependencies try this trick, Socket will alert you immediately. Just enable "Manifest Confusion" detection in your dashboard settings. 🚨🔒

1

2

6

Socket

@SocketSecurity

2 years

@mikemaccana Snyk, and most of the security industry, are obsessed with scanning for "known vulnerabilities", an approach which is too reactive to stop a supply chain attack. Vulnerabilities can take weeks or months to be discovered.

1

0

6

Socket

@SocketSecurity

8 months

Lack of funding for open source projects and contributors can lead to burnout. It's a challenging problem the ecosystem is still working to figure out:

The Register

@TheRegister

9 months

Burnout epidemic proves there's too much Rust on the gears of open source

0

4

10

0

2

6

Socket

@SocketSecurity

3 years

If you want to watch @Feross 's presentation at @NodeCongress it's now available on YouTube here: ✨✨✨

It's a Jungle Out There: What's Really Going on Inside Your Node_Mo...

Node Congress 2022 #NodeCongress #Node #GitNationWebsite – https://nodecongress.com/Follow the link to watch the full version of all the conference talks, Qn...

www.youtube.com

Tushar Joshi

@tusharvjoshi

3 years

@feross amazing eye opener presentation of inner workings of node_modules and the risks involved at @NodeCongress most interesting session this year #NodeCongress

1

4

18

0

4

6

Socket

@SocketSecurity

2 years

Don’t miss this conversation between Socket founder @feross and @bdougieYO where they discuss: - Feross’s open source journey - The inside story of the npm funding experiment - Why Feross started Socket to improve OSS security - Many stories of interesting attacks in the wild!

OpenSauced

@saucedopen

2 years

Making Money on Open Source | @feross shares The Secret Sauce

4

12

40

0

3

6

Socket

@SocketSecurity

2 years

The Socket team will be at Black Hat and DEFCON next week. If you'd like to meet up to chat about open source security or see a demo, send us a DM!

0

1

6

Socket

@SocketSecurity

8 months

📦 This update also significantly improves support for PyPI and Golang, speeds up scan times, and includes a new syntax for specifying package ignores. Check out everything that's new:

Socket for GitHub v2 Introduces Diff Reports, Speeds Up Scan Times - Socket

The latest update of Socket for GitHub features a new web-based diff report viewer, enhanced support for PyPI and Golang, faster scan times, and a new...

socket.dev

0

5

4

Socket

@SocketSecurity

5 months

Researchers claim to have created a GPT-4 agent that can autonomously exploit web vulnerabilities in real-world systems with an 87% success rate. We're not too far away from seeing fully autonomous exploits.

The AI Advantage: Reshaping Cybersecurity in the Age of Autonomous Threats - Socket

As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabil...

socket.dev

1

4

6

Socket

@SocketSecurity

2 years

As maintainers of open source packages which are installed over 1 billion times per month, the Socket team is intimately familiar with the massive growth in open source usage.

1

2

6

Socket

@SocketSecurity

11 months

🎙 Just wrapped up a podcast with @riskybusiness where we dived into how Socket is using LLMs for software security.

1

3

6

Socket

@SocketSecurity

9 months

On a recent episode of the @DevtoolsFM podcast, @feross explained how Socket uses LLMs to analyze packages and detect supply chain security risks. Check out the full episode this weekend:

1

5

6

Socket

@SocketSecurity

2 years

Join us in supporting online privacy, free speech, and digital access. @EFF has fought for tech users for over 30 years, and it's more important now than ever before.

Defend Privacy and Free Speech

Donate to the Electronic Frontier Foundation and support the mission to defend civil liberties and human rights online. You can help EFF’s attorneys, activists, and technologists protect privacy,...

supporters.eff.org

0

2

6

Socket

@SocketSecurity

6 months

Valkey, one of the newest open source Redis forks, gains momentum with Linux Foundation backing and support from industry giants like Amazon, Google Cloud, and Oracle. @reconditerose @linuxfoundation @awscloud

“Valkey” Open Source Redis Fork Backed by Linux Foundation, Amazon, Google Cloud, Oracle, Ericsson,...

Valkey, a high-performance key-value store and open source Redis fork, gains momentum with Linux Foundation backing and support from industry giants l...

socket.dev

0

3

6

Socket

@SocketSecurity

8 months

🚀 We completed a major revamp of our Socket for GitHub app! v2 introduces support for diff reports with a web-based report viewer.

1

2

5

Socket

@SocketSecurity

2 years

Socket is proud to sponsor @JSPM ❤️

JSPM

@jspm

2 years

Pleased to announce our latest sponsor, @SocketSecurity ! It's been inspiring to follow their new approach to mitigating the very real JS supply chain risks with the platform. Thank you for supporting JSPM, another step towards sustainability...!

1

4

9

0

2

4

Socket

@SocketSecurity

5 months

Socket flags a near constant stream of malicious code uploaded to public package registries targeting Discord. On the blog today our research team breaks down a few of these trends:

Recent Trends in Malicious Packages Targeting Discord - Socket

The Socket research team breaks down a sampling of malicious packages that download and execute files, among other suspicious behaviors, targeting the...

socket.dev

0

4

5

Socket

@SocketSecurity

1 year

2. The culprit? A seemingly harmless NPM package called 'pyautodllxd'. It doesn't impersonate any popular package, but a closer look at the postinstall command reveals a hidden trove of suspicious code. 🕵️‍♂️

The “Skeleton Squad” is now targeting NPM - Socket

Digging into the Skeleton Squad's recent expansion from PyPI to the npm ecosystem.

socket.dev

1

2

5

Socket

@SocketSecurity

10 months

🚨 An investigation into npm registry spam: Socket researchers deconstruct a Python script automating a massive campaign that published 5,000+ spam packages to npm. Read more about how this trend in spam campaigns is impacting the open source ecosystem:

Exposing Automation of npm Registry Spam - Socket

A recently uncovered Python script highlights a spam campaign tactic where malicious actors automate the publishing of spam packages to the npm packag...

socket.dev

0

3

5

Socket

@SocketSecurity

5 months

CISA launched a new project called Vulnrichment to enrich CVEs with details that help prioritize patching and mitigation efforts. Meanwhile, the NVD backlog has surpassed 10,000. Conflicting CPE strings pose challenges for implementation. #security

CISA Launches Vulnrichment Project as NVD Backlog Hits 10,000 - Socket

CISA launched a new project called Vulnrichment to enrich CVEs with details that help prioritize patching and mitigation efforts, as the NVD backlog o...

socket.dev

0

1

4