Socket · Blogs

Blogs listings from Socket on TechiSeek. 128 public listings.

• A Short History of Protestware (Socket)
  This short history of protestware - from punch cards to package managers - explores the intriguing and controversial phenomenon of digital…
• Socket Named Among Top Cybersecurity Companies in Fortune’s Cyber 60 List (Socket)
  Socket has been recognized in Fortune’s new Cyber 60 list, among other companies innovating in the cybersecurity industry.
• 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads (Socket)
  Socket researchers found 18 Chrome extensions and one Edge extension delivering a wallet drainer, credential theft, and other malicious pay…
• npm Registry Code Signing (Socket)
  Socket explains the newly released npm provenance provided by GitHub.
• Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts (Socket)
  A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account…
• Andrew Becherer Joins Socket as Chief Information Security Officer (Socket)
  Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.
• AI + a16z Podcast: Vibe Coding, Security Risks, and the Path to Progress (Socket)
  Socket CEO Feross Aboukhadijeh and a16z partner Joel de la Garza discuss vibe coding, AI-driven software development, and how the rise of L…
• Introducing "safe npm", a Socket npm Wrapper (Socket)
  Socket is proud to introduce an exciting new tool—“safe npm”—that protects developers whenever they use npm install.
• Socket Joins Forces with Ecosystems to Strengthen Open Source Security (Socket)
  Socket partners with Ecosystems to build and maintain secure, resilient, and sustainable open source ecosystems.
• Announcing SOC 2 Type 1 Compliance (Socket)
  Socket has successfully completed the SOC 2 Type I audit by meeting rigorous security and confidentiality standards.
• From Academia to Industry (Socket)
  Philipp Burckhardt recounts his journey from childhood computer fascinations, to building an e-learning platform at Carnegie Mellon Univers…
• Meet the Socket Team at RSAC and BSidesSF 2026 (Socket)
  Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.
• 77 Firefox Extensions Linked to Crypto Wallet and Credential Theft (Socket)
  Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
• The AI Industry Is Betting on Open Weights (Socket)
  An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight…
• UK Cyber Test: AI Agent Attempted to Social Engineer Open Source Maintainer Into Merging Malware (Socket)
  During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge mal…
• Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader (Socket)
  4 compromised asyncapi packages deliver miasma botnet loader on macOS, Linux and Windows.
• What's Really Going On Inside Your node_modules Folder? (Socket)
  Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.
• Open VSX Unblocks Extension IDs Used in Malware Campaign (Socket)
  Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the…
• Using GPT at Work (Socket)
  We have been using GPT at Socket to help triage the npm package firehose for a couple months now.
• White House Authorizes Private Companies to Conduct Offensive Cyber Operations (Socket)
  A new federal program will let vetted U.S. cybersecurity firms help investigate and disrupt foreign cybercrime groups under government dire…
• Announcing Precomputed Reachability Analysis in Socket (Socket)
  Socket’s precomputed reachability slashes false positives by flagging up to 80% of vulnerabilities as irrelevant, with no setup and instant…
• pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90% (Socket)
  pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.
• Why Socket is the Best Tool for Developers to Stop Supply Chain Attacks (Socket)
  What supply chain attacks are, and how Socket can help protect you from them.
• Turtles, Clams, and Cyber Threat Actors: Shell Usage (Socket)
  The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persi…
• TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack (Socket)
  Socket detected 84 compromised TanStack npm package artifacts modified with suspected CI credential-stealing malware.
• 11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload (Socket)
  11 malicious NuGet tools pose as game cheats to deploy Windows payloads, track hosts, and use Google Sheets for telemetry and control.
• Introducing Tier 1 Reachability: Precision CVE Triage for Enterprise Teams (Socket)
  Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.
• Popular Rust Crates Compromised in Build-Time Supply Chain Attack (Socket)
  Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.
• New AISI Report Details How GPT-6 Astra Turned CTF Challenges Into Supply Chain Attacks (Socket)
  GPT-6 Astra tried to plant malicious code in simulated open source projects using fake GitHub accounts and deceptive PRs during an assigned…
• Microsoft Teams Notifications Are Now Available in Socket (Socket)
  Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each chan…
• Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets (Socket)
  Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
• The Benefit of Doing Reachability Analysis (Socket)
  Focusing on actionable vulnerabilities, The Coana SCA with reachability analysis enhances efficiency and security.
• GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing (Socket)
  GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
• How AI Agents Expand the Software Supply Chain Attack Surface (Socket)
  In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security…
• Limitations of CVE-Based Security Scanners: A Deep Dive into 3 Notable Supply Chain Attacks (Socket)
  Vulnerability scanners provide a false sense of security to appsec teams and do little to prevent supply chain attacks.
• Nominating Bradley Meck Farias for OpenSSF Governing Board (Socket)
  Socket is nominating Bradley Meck Farias as a representative to the OpenSSF Governing Board.
• Socket at BSidesSF and RSA Conference 2023 (Socket)
  Socket at BSidesSF and RSA Conference 2023 Socket is back at BSidesSF and RSA! - Feross Aboukhadijeh Socket is back at BSidesSF, and this t…
• Socket Releases Free Certified Patches for Nuxt Security Vulnerabilities (Socket)
  Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server i…
• Socket VSCode Extension (Socket)
  Introducing a VS Code editor integration for Socket Security.
• Obfuscation 101: Unmasking the Tricks Behind Malicious Code (Socket)
  Attackers use obfuscation to hide malware in open source packages. Learn how to spot these techniques across npm, PyPI, Maven, and more.
• How to Use Socket in Your GitLab Pipeline for Enhanced Security (Socket)
  How to Use Socket in Your Git Lab Pipeline for Enhanced Security A short walkthrough of how to integrate Socket into the Gitlab CI/CD proce…
• 6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat (Socket)
  Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defen…
• Announcing Socket for GitHub 1.0 (Socket)
  Announcing Socket for Git Hub 1.0 Today we're shipping a big update to Socket for Git Hub to help developers protect their apps from softwa…
• GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk (Socket)
  GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent…
• Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source (Socket)
  Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementatio…
• Insecure Agents Podcast: How to Keep AI Agents From Bypassing Security Controls (Socket)
  Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.
• Vite Releases Technical Preview of Rolldown-Vite, a Rust-Based Bundler (Socket)
  Vite releases Rolldown-Vite, a Rust-based bundler preview offering faster builds and lower memory usage as a drop-in replacement for Vite.
• Socket at Black Hat and DEF CON 2023 (Socket)
  Socket is back at Black Hat and DEF CON.
• Goals for Modern Online File Explorers (Socket)
  File explorers are great tools for programmers when they can let code be understood, but what does it take to ship a file explorer and what…
• Jerod Santo Joins Socket as Head of Media (Socket)
  Jerod Santo Joins Socket as Head of Media Allow myself to introduce... Supply chain attacks are going parabolic in both frequency and impac…