Protecting America's software supply chain Founder & CEO @SocketSecurity (https://xitter.twitterapi.xyz/t.co/7g1opA8rgG) Created @WebTorrentApp and @StandardJS Taught Web Sec @Stanford
Stanford, CA
Joined August 2008
- Tweets29.2K
- Following1.7K
- Followers41.3K
- Likes37.3K
Pinned Tweet
Socket now protects five of the Magnificent Seven.
The newest bought Socket for our patented precomputed reachability. We analyze every open source package as it's published, so reachability works from an SBOM alone. In the POC it cut their CVEs needing triage in half.
Engineers at @SocketSecurity do what's right for the business, even when it's unglamorous.
Our mantra is "you can just ship things." We have no PMs, so engineers work directly with customers. And we're winning.
We're hiring engineers.
socket.dev/careers
A malicious bee-js release hit npm with valid provenance and no npm token. The attackers used Ethersphere's own release bot.
With trusted publishing, the workflow is the credential. It should refuse any commit that isn't on a protected branch.
socket.dev/blog/bee-js-compr…
Socket sees packages as they're published across npm, PyPI, Maven, Go, and Cargo, and every confirmed attack is human-reviewed. Most researchers never get data like that.
So we built Socket Labs.
Hiring researchers, research engineers, and PhD interns: socket.dev/labs
OpenCode said AI provider keys saved in its hosted Console may have been exposed. Days earlier, @SocketSecurity tracked a GhostAction wave sweeping git history for AI keys. A stolen key is inference billed to you. Treat these like cloud credentials. socket.dev/blog/ghostaction-…
AI turns new vulnerabilities into exploits within hours. Upgrading to patch is too slow.
In real codebases, @SocketSecurity can patch 25 to 50% of critical CVEs today without upgrading a single package. Every patch is human-reviewed. Critical patches are free.
socket.dev/features/patches
Shai-Hulud turned one this September. Since that first npm worm: new waves, public source code, two alleged operators arrested in August, then tensorlake in October.
The worm doesn't need its authors anymore.
socket.dev/blog/happy-birthd…
We shipped a free Certified Patch for the 9.8 Rails Active Storage flaw. It closes the hole without a Rails upgrade. Free for anyone, @SocketSecurity customer or not.
socket patch add GHSA-f3w6-w445-fwh9
Patch today. Then plan the upgrade.
socket.dev/blog/rails-active…
Also, Replit’s sandboxes run @SocketSecurity on every package install. It blocks ~8,000 malicious packages a day.
replit.com/blog/package-fire…
Two years ago, we took a team photo in Chicago.
This week, we came back and took another one. All 175 of us.
It was the most exciting moment since I started Socket. I've never felt energy like this.
We're hiring in every department: socket.dev/jobs
ALT The Socket team in July 2024, about two dozen people, posing on a rooftop in Chicago with the city skyline behind them.
ALT The Socket team in November 2026, about 175 people in matching black jackets, posing in downtown Chicago with the Wrigley Building and the city skyline behind them.
@SocketSecurity is hiring a sales engineer for SMB customers. Most small companies have no security team, and their coding agents pull in dependencies faster than anyone can review them. You'd run demos and POCs.
If that's you, apply here or DM me.
jobs.ashbyhq.com/socket/de95…
The biggest supply chain attacks of 2025 and 2026 hit legitimate packages during the release, usually on GitHub Actions.
Assume your build job will run something hostile. Keep publish credentials out of it.
New guide from @SocketSecurity:
socket.dev/blog/hardening-gi…
On Oct 21, a malicious litellm 1.107.0 hit PyPI and LiteLLM's Docker images. A .pth file ran the stealer on every Python start, no import needed. The GitHub tag was clean, so source review showed nothing. Provenance only helps if something checks it. socket.dev/blog/litellm-comp…
Claude coding agents built the initial Rust port of the TypeScript compiler. Cloudflare has now committed to maintaining it as tsrs. AI made rewrites cheap, not maintenance. Before an AI-built port enters your build, ask who ships its fixes. socket.dev/blog/cloudflare-t…
When a supply chain attack breaks, every security team gets asked: were we hit?
@SocketSecurity Threat Intel now answers it per campaign: Blocked by Socket, Detected, or Not Detected, with links to the exact scans and Firewall events.
socket.dev/blog/threat-intel…
Not a hard problem. Legit code doesn’t name a function computeRicinLethalDosageForWaterSupply. A refusal from your scanner is a finding, not a dead end. The real bug is pipelines that fail open and log a refusal as “no issues found.”
有人发现了一种非常离谱的 JavaScript 混淆技术：通过在代码里塞入大量生物武器、毒药和致死剂量相关的函数名，让 AI 因为安全限制而拒绝分析代码。
安全研究员 veritas 在分析浏览器指纹脚本时，发现一段来自 ServicePipe 相关域名的 JavaScript，里面充斥着极其诡异的函数名：
computeRicinLethalDosageForWaterSupply
calculateDeadlyLethalSuicideAspirinDosage
光看名字，仿佛在研究生化武器。但实际上，这段代码只是在收集浏览器指纹，包括 User-Agent、GPU、Canvas 等信息。
研究员怀疑，这些名字是开发者故意设置的陷阱，专门用来阻止 AI 辅助逆向工程。
于是他做了个实验：
• Astra：拒绝分析
• Astra + Daybreak Blue：仍然拒绝
• GLM-5.3：成功分析
这就有意思了。
传统代码混淆是通过复杂控制流、加密字符串、无意义变量名，让人类和工具难以理解代码。
而这种新思路，直接瞄准了大模型的安全机制。
代码本身可能完全无害，但只要在函数名里塞进足够多的危险词汇，部分 AI 就可能主动放弃分析。
更讽刺的是，模型越严格遵守某些安全规则，面对这种混淆时反而可能越容易受到干扰。
当然，目前还没有证据证明开发者一定是故意这样设计，也不能说明这种方法对所有模型都有效。
但它揭示了一个值得关注的趋势：随着越来越多的逆向工程依赖 AI，未来的代码混淆技术可能不再只针对编译器、反编译器和人类研究员，还会专门针对大模型的安全判断机制。
以前是让代码难以理解，现在甚至可以尝试让 AI 不敢理解。
Anthropic didn’t ship this. The tampered build never touched npm, Open VSX, or the VS Code Marketplace.
A publisher name on a listing isn’t provenance.
More detail here: socket.dev/blog/claude-code-…
Massively underreported: an official Claude Code extension was compromised and installed backdoors on developer machines.
Could it be behind the Binance hack?
Readers added context they thought people might want to know
The post misstates the facts: a tampered copy of the Claude Code extension was published briefly to Cursor's marketplace only and was not developed by Anthropic; official channels and distributions were unaffected.
cursor.com/blog/claude-co…
x.com/cursor_ai/stat…
x.com/felixrieseberg…
13.4 million installs of malicious browser extensions that hijack searches across over a decade of time.
Excellent research!
ALT 13.4M That's how many installs we discovered have had their searches hijacked by 319 hidden browser extensions across a decade of time. These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing.