Socket @SocketSecurity

Socket is the #1 software supply chain security platform. Next-gen SCA + SBOM + 0-day prevention. LOVED BY DEVELOPERS. 👀 @npm_malware socket.dev https://socket.dev/careers Joined November 2021

Tweets

3K
Followers

23K
Following

5K
Likes

2K

Socket @SocketSecurity

21 hours ago

Lovable rewrote Vite’s dev server in Rust. OJ uses ~75% less memory, and Lovable now provisions sandboxes in 3 seconds instead of 14.5. Evan You thinks AI may make these tailored rewrites more common to where everyone "maintains their own slop fork.” socket.dev/blog/oj-vite-r…

0 5 11 2K 3

View Details

Feross @feross

2 days ago

The wildest part of a recent npm attack: the C2. The malware phoned home over libp2p, the BitTorrent DHT, IPFS, Ethereum smart contracts, and Nostr relays. Every decentralization protocol, as command-and-control: risky.biz/RBNEWSSI140/

0 3 14 2K 5

View Details

Tanner Linsley @tannerlinsley

a day ago

@npmjs Purchase @SocketSecurity and just scan the universe all the time, every time, even before package publish. Don't make me stage.

4 3 40 3K 5

View Details

Socket @SocketSecurity

2 days ago

@CloudSecList @StackLokHQ @OX__Security @intigriti @datadoghq Thanks for including Socket! 🙌

0 0 1 274 0

View Details

NodeConf EU @NodeConfEU

2 days ago

🥁 𝐒𝐩𝐞𝐚𝐤𝐞𝐫 𝐀𝐧𝐧𝐨𝐮𝐧𝐜𝐞𝐦𝐞𝐧𝐭🎙️ Thrilled to have @MikolaLysenko on the #NodeConfEU 2026 stage! He'll tell us the story of "𝐃𝐞𝐥𝐞𝐭𝐞 𝐚𝐥𝐥 𝐂𝐕𝐄𝐬." 🎟️Don't miss it out; secure your tickets nodeconf.eu

1 5 6 1K 1

View Details

Socket @SocketSecurity

4 days ago

It's been one year since the Shai-Hulud npm worm was unleashed on the software supply chain, kicking off the worst year for npm security on record. It's now open source and has since torn through thousands of packages and organizations on its rampage. socket.dev/blog/happy-bir…

0 7 15 3K 7

View Details

lazarusholic @lazarusholic

5 days ago

"PolinRider Spreads Through Compromised GitHub Accounts and Packagist" published by @SocketSecurity. #GitHub, #EtherHiding, #VSCode, #PolinRider, #NullReceiver socket.dev/blog/polinride…

0 3 7 1K 3

View Details

Socket @SocketSecurity

5 days ago

We’re tracking more North Korea-linked PolinRider activity across GitHub and Packagist. New findings: 4 malicious dev versions, rewritten Git history, and obfuscated JavaScript planted in index.php and executed through PHP’s shell_exec() function. socket.dev/blog/polinride…

0 8 19 3K 9

View Details

Socket @SocketSecurity

6 days ago

GitHub added cache-mode to GitHub Actions, a new control that limits cache access at the workflow or job level to reduce cache poisoning, the technique behind several recent high-profile supply chain attacks on npm and PyPI. socket.dev/blog/github-ac…

3 6 29 4K 10

View Details

Feross @feross

a week ago

Ten years ago @jerodsanto had me on @changelog to talk about @WebTorrentApp. Today he joins @SocketSecurity as Head of Media. Most people know Jerod from The Changelog, where he spent over a decade building one of the best developer podcasts in the industry. He also made me a regular panelist on @JSPartyFM in 2018, so I've seen how he works up close. He's exceptional at it. He believed in Socket early, too. He was an early angel investor and has watched the company grow from the inside. Supply chain attacks are accelerating in frequency and impact. Every week brings a new named attack, a new worm, a new AI-assisted exploit. Most of the public conversation is hot takes. Developers and security teams deserve real analysis, from people who know what they're talking about, in formats they actually consume. That's the job. Podcasts, video, writing. Nobody I know is better suited for it. One more thing. This is Jerod's first full-time job since 2012. Fourteen years of independence, and he chose Socket. I don't take that lightly. Read his first post: socket.dev/blog/jerod-san…

Socket @SocketSecurity

a week ago

🎉 We're excited to welcome @jerodsanto to Socket as our first Head of Media. After more than a decade as one of the most trusted voices in developer media, he's setting his sights on supply chain security. Find out what he's cooking up at Socket. socket.dev/blog/jerod-san…

0 4 13 6K 2

1 4 14 3K 0

View Details

Jerod Santo @jerodsanto

a week ago

I'm joining @feross and the gang as Head of Media at @SocketSecurity! jerodsanto.net/2026/09/joinin…

2 5 20 2K 1

View Details

Socket @SocketSecurity

a week ago

0 4 13 6K 2

View Details

The Wall Street Journal @WSJ

2 weeks ago

The incident, which wasn’t previously linked to OpenAI, happened two months before July’s Hugging Face hack. on.wsj.com/46jHme8

37 82 308 214K 84

View Details

Feross @feross

2 weeks ago

OpenAI confirmed its agents were behind the GemStuffer incident. Sandboxed during a training run without full internet access, they used the registry as a makeshift web browser to reach the open web. Story by @bobmcmillan with analysis from @socketsecurity wsj.com/tech/ai/cybera…

3 6 30 5K 16

View Details

The Hacker News @TheHackersNews

2 weeks ago

🚨 A new report links OpenAI agents to a RubyGems campaign that gained RCE on RubyDoc servers. The activity pushed 2,000+ packages, exfiltrated public data, and attempted to steal API keys. How the chain worked: thehackernews.com/2026/09/openai…

10 23 68 42K 26

View Details

Sarah Gooding @sarahgooding

2 weeks ago

🔥 @SocketSecurity in WSJ today:

The Wall Street Journal @WSJ

2 weeks ago

The incident, which wasn’t previously linked to OpenAI, happened two months before July’s Hugging Face hack. on.wsj.com/46jHme8

37 82 308 214K 84

0 2 3 1K 0

View Details

Socket @SocketSecurity

2 weeks ago

Socket researchers found a malicious Twitch browser extension on Chrome and Firefox with 30,000+ reported users. It forwards full account-scoped OAuth tokens to a Russian bot service, exposing chat, whispers, and account settings. socket.dev/blog/malicious…

2 9 26 8K 7

View Details

Sarah Gooding @sarahgooding

2 weeks ago

Open source registries are the fastest ways to distribute code at scale. Maintainers and registry operators should be ready for agents to exploit that reach, whether the ecosystem is their target or simply on the path to one.

Socket @SocketSecurity

2 weeks ago

Anthropic reports biased reasoning and recklessness fueled Claude’s PyPI attack. Mythos 5 ignored signs it was on the real internet, published malware to PyPI, then used credentials leaked by a vendor’s scanner to access that vendor’s live database. socket.dev/blog/claude-py…