Socket

🚀 Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization. Campaign summaries bring together repository scans and Firewall activity, so you can quickly check your organization’s exposure.

Node patched eMudhra and Brotli last week, but updating Node only covered part of the problem. Other applications carried their own copies of Brotli or still trusted the compromised certificates, leaving teams with more software to find and fix. socket.dev/blog/emudhra...

The Simpsons tried to warn us... 🥦

Microsoft made TypeScript roughly 10× faster by porting its compiler and tooling to Go. Now Cloudflare’s @voidzero.dev team is working with the #TypeScript team on tsrs, a Rust port reporting up to 8× faster checks than TS 7.0 and ~70% less memory. socket.dev/blog/cloudfl...

🚨 New investigation: Socket found malicious LiteLLM workflows running 11 days before the attack, targeting 20 secrets including GitHub, cloud, and AI credentials. After our disclosure, LiteLLM linked a stolen token to approval of the malicious release. socket.dev/blog/litellm...

PHP2Shell exploits are a massive fail (so far)

Microsoft made TypeScript roughly 10× faster by porting its compiler and tooling to Go. Now Cloudflare’s @voidzero.dev team is working with the #TypeScript team on tsrs, a Rust port reporting up to 8× faster checks than TS 7.0 and ~70% less memory. socket.dev/blog/cloudfl...

Everything is hacked! This is fine? 🫠

Chainguard got PHP’s emergency RCE fix under embargo, like every other distributor. It published patched images 6+ hours before the coordinated release. The PHP Foundation says any attacker could then study the fix in binary form while every other PHP user waited.

When agents become the interface, what replaces the security controls the UI provided? Tomorrow at AGNTCon + MCPCon, I’ll debate that with Dexter Horthy, Ian Livingstone and Scott Sanders. Allie Howe moderates. Oct. 22, 2:55 p.m. PT. Come join us.

The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early: “This disregarded weeks of work by many parties toward a coordinated disclosure.” socket.dev/blog/php-emb...

vlt 1.5.0 links agent skills from your dependencies to coding agents, with versions pinned by your lockfile. The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents. socket.dev/blog/vlt-ski... @vlt.io

vlt 1.5.0 links agent skills from your dependencies to coding agents, with versions pinned by your lockfile. The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents. socket.dev/blog/vlt-ski... @vlt.io

🧊 Rust 1.100 will let developers put fresh dependency releases on ice. Cargo’s opt-in cooldowns give researchers and maintainers time to catch malicious crates before more projects pull them in. socket.dev/blog/rust-ca...

Given that the vlt CLI is a proper package manager, you get all the benefits like a lockfile and automatic filter of undesirable packages using data from our partner @socket.dev Read more about this release in our blog post: www.vlt.io/blog/vlt-ski...

Don't tell Michael Scott the bankruptcy system is down 🤐

Deno spent years persuading developers to bet on a better runtime. Now its creator calls gains over Node.js “marginal” and says it was “sucked into the gravity well of node compatibility.” The backlash, the forks, and how AI is changing the future of JavaScript runtimes. socket.dev/blog/deno-ac...

Excited to launch this! 🎉 If you're building in collaboration with agents on Origin, install the Socket integration to keep an eye on the dependencies they bring in and flag any supply chain risks.

Things I know? Dan Nguyen-Huu is the best in the business and time spent with him is always time well spent. If cybersecurity and securing engineering organizations in this AI fever dream are your cup of tea 🫖 ? Checkout our recent conversation.

Deno spent years persuading developers to bet on a better runtime. Now its creator calls gains over Node.js “marginal” and says it was “sucked into the gravity well of node compatibility.” The backlash, the forks, and how AI is changing the future of JavaScript runtimes. socket.dev/blog/deno-ac...

Anthropic is giving open source maintainers a fast track to Mythos vulnerability findings. Its free OSS Scanner delivers recurring audits, reports showing how to reproduce vulnerabilities, and proposed fixes when available. socket.dev/blog/anthrop...

Anthropic researchers just ran a 26-billion-parameter model across fifteen cheap Android TV boxes 🤯

“It’s never been easier to build a security program. It’s never been harder to secure an organization.” 🎙️ Socket CISO Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust. 👇 socket.dev/blog/front-l...

🚀 Socket for Origin is now available in Cursor's App Marketplace! Automatically scan dependency changes for malware, compromised updates, and other supply chain risks. Get findings directly on your pull requests, before you merge. socket.dev/blog/socket-...

Agent Baseline published a reference architecture today for securing software factories, with four boundaries enforced outside the agent. Co-authored by Socket CTO @ahmadnassri.com with leaders from Docker, Keycard, Barclays, and Secure Theory. socket.dev/blog/agent-b...

Update: Socket has identified more than 500 GitHub accounts that committed the malicious GhostAction workflow to tens of thousands of repositories since October 7, including organization-owned repositories reached through compromised contributors.

Fun fact.. Node.js was downloaded nearly 900 million times in July alone.

"Our moderators are observing an increase in thin papers of narrow scope, as well as ‘salami’ papers, where a single work is broken up and submitted as a set of smaller papers. There is also a marked increase in dense, AI-written papers." - @arxiv.bsky.social socket.dev/blog/arxiv-r...

🚨 Tensorlake’s npm SDK (12K weekly downloads) was compromised in a ChainDrop / Shai-Hulud attack. Version 0.5.144 contains a credential-stealing worm with a dead-man switch designed to execute attacker code when a stolen GitHub token is revoked. socket.dev/blog/tensorl...

🚀 Socket now scans VS Code Marketplace extensions! You can vet every dependency in your app and still get compromised by an extension in your editor. We analyze all 100,000+ extensions in the VS Code Marketplace and their updates for malicious code and risky behaviors.