Socket

We started?Socket?with a simple but audacious goal: to safeguard the open source ecosystem for everyone. Today, that dream is a bit brighter—literally! Our logo is lighting up Times Square! Every great company is a conspiracy to change the world.?Thank you to our many co-conspirators — our early customers, founding employees, investors, mentors, and the open source and security communities — we wouldn't be here without your support. We're just getting started.

?? New Threat Research: 3 malicious #npm packages are typosquatting popular cryptographic libraries, targeting #crypto asset developers with keylogging and wallet theft. These packages are still live on npm with more than 1,000 downloads. https://lnkd.in/e3fNCcxm #NodeJS #javascript #cybersecurity?

?? Weekly download counts are now displayed for each npm package when searching on Socket! This gives you a quick popularity gauge, so you can easily identify widely-used packages in search results. Many thanks to Wes Bos for the feature suggestion on the Syntax podcast! https://lnkd.in/eukuthHu

?? A Stanford study reveals 9.5% of software engineers do virtually no meaningful work, costing tech $90B+ annually, with remote work fueling the rise of "ghost engineers." https://lnkd.in/e9_ZRbEa

? You can check open source software for 70 indicators of compromise Feross Aboukhadijeh explains how Socket helps Developers evaluate open source risks via web browsers extensions that caution and warn in very early evaluation stages. An ounce of preventions is worth a pound of cure. Feross is an entrepreneur with a successful exit on his resume. Feross is also a graduate of Stanford, an active venture capital investor, and a talented open source developer who has built WebTorrent, assisted Brave Software, and uplifted Javascript projects. The Full Episode with Host Scott Brammer from The Cyber Security Council is available here: https://lnkd.in/g3wnMzYH Special Guest Feross Aboukhadijeh CEO and Co-Founder at Socket

?? Socket’s threat research team has detected six malicious #npm packages typosquatting popular libraries to insert SSH backdoors. These packages are still live on npm. https://lnkd.in/g9rCAQ9Q #JavaScript #cybersecurity

MITRE published its 2024 CWE Top 25 Most Dangerous Software Weaknesses list. There are some familiar faces at the top of the rankings: XSS, SQL Injection, and CSRF are all still pervasive issues. https://lnkd.in/ekPHRrxu #CyberSecurity

?? On this episode of the Risky Business podcast Feross shared some of the malware we’ve seen in open source package registries recently, including author typosquatting and malware leveraging Ethereum smart contracts to evade detection. Check out the full episode: https://lnkd.in/eMkR4tfr

We replicate OSS registry feeds in real time, often catching threats within seconds of the package being published. Users are protected while we work with the registries to get malicious packages removed. And all the package info is available for free on our website. Check out Feross’s interview w/ Patrick Gray: https://lnkd.in/eMkR4tfr

Socket founder and CEO Feross Aboukhadijeh joined Patrick Gray on the Risky Business podcast where they discussed some of the challenges of tracking open source malware in the absence of a standardized repository for cataloging malicious packages. Check out the full episode: https://lnkd.in/eMkR4tfr