Socket · Blogs

Blogs listings from Socket on TechiSeek. 128 public listings.

• CyberBytes Podcast: Open Source Security Shifts Towards Tackling Supply Chain Threats (Socket)
  On the CyberBytes podcast, Socket CEO Feross Aboukhadijeh discusses the challenges in OSS security, the hacker mindset, and the shift towar…
• Introducing License Enforcement in Socket (Socket)
  Ensure open-source compliance with Socket’s License Enforcement Beta. Set up your License Policy and secure your software!
• Socket Is Sponsoring Composer and Packagist (Socket)
  Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecos…
• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX (Socket)
  Socket uncovered two malicious VS Code themes in a GlassWorm-linked cluster with thousands of installs across VS Code Marketplace and Open…
• Socket Partners with Replit to Block Malicious Packages in AI-Powered Development (Socket)
  Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packag…
• Claude Breached 3 Companies and Uploaded Malware to PyPI During Anthropic's Security Tests (Socket)
  A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing pa…
• MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack (Socket)
  The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents.
• Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign (Socket)
  Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
• Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache (Socket)
  The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
• Risky Biz Podcast: Using LLMs for Analysis and Explanation in Software Supply Chain Security (Socket)
  How Socket uses LLMs to enhance both the analysis and explanation of open-source software packages.
• Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers (Socket)
  Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba dev…
• Introducing Socket Scanning for OpenVSX Extensions (Socket)
  Socket now scans OpenVSX extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in deve…
• Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan (Socket)
  Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.
• 13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds (Socket)
  Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wa…
• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials (Socket)
  Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX i…
• How Socket Combats Insidious Typosquatting Supply Chain Attacks (Socket)
  Supply chain attacks that leverage typosquatting are steeply rising over previous years. Learn how Socket for GitHub and Socket CLI can pro…
• Fake Corepack Site Distributes Infostealer and Proxyware to Developers (Socket)
  A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
• $4.6M Series Seed to defend open source from supply chain attacks (Socket)
  $4.6 M Series Seed to defend open source from supply chain attacks Redefining open source security through proactive supply chain risk mana…
• Socket Named to Rising in Cyber 2026 List of Top Cybersecurity Startups (Socket)
  Socket was named to the Rising in Cyber 2026 list, recognizing 30 private cybersecurity startups selected by CISOs and security executives.
• Introducing Immutable Scans (Socket)
  Scan results now load faster and remain consistent over time, with stable URLs and on-demand rescans for fresh security data.
• Creating an Effective Vulnerability Management Program for Open Source Vulnerabilities (Socket)
  Learn how to design a sustainable vulnerability management program by balancing risk tolerance, security policies, and team resources.
• NIST Proposes AI-Enabled NVD Overhaul After Cutting Routine CVE Enrichment (Socket)
  NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans prod…
• Socket Recognized for Second Consecutive Year on Fortune Cyber 60 List (Socket)
  Socket has been recognized for the second consecutive year on the Fortune Cyber 60 list, which identifies the most significant venture-back…
• Announcing SOC 2 Type 2 Compliance: Ensuring the Highest Standards of Security (Socket)
  Socket is thrilled to announce that we have achieved a sparkling clean SOC 2 Type 2 attestation report.
• Introducing Socket Scanning for VS Code Marketplace Extensions (Socket)
  Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in deve…
• New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials (Socket)
  A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git histo…
• arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions (Socket)
  arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying t…
• TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack (Socket)
  Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.