Socket @SocketSecurity

Socket is the #1 software supply chain security platform. Next-gen SCA + SBOM + 0-day prevention. LOVED BY DEVELOPERS. 👀 @npm_malware socket.dev https://socket.dev/careers Joined November 2021

Tweets

2K
Followers

5K
Following

5K
Likes

2K

SC Media @SCMagazine

a day ago

An @npmjs package designed to steal credentials hid its malicious payload in a QR code image, @SocketSecurity reported. #cybersecurity #infosec #ITsecurity bit.ly/42OytYv

0 3 3 856 0

SC Media @SCMagazine

3 days ago

An @npmjs package designed to steal credentials hid its malicious payload in a QR code image, @SocketSecurity reported. #cybersecurity #infosec #ITsecurity bit.ly/42OytYv

0 3 2 2K 0

Taryn Plumb @taryn_plumb

5 days ago

Malware in QR codes 🤯

1 1 5 2K 3

0 1 5 2K 1

SC Media @SCMagazine

5 days ago

An @npmjs package designed to steal credentials hid its malicious payload in a QR code image, @SocketSecurity reported. #cybersecurity #infosec #ITsecurity bit.ly/42OytYv

0 1 5 3K 1

Historic npm hijack & only $500 in ETH stolen. But the real story isn’t the money, it’s the fragility of open source supply chains. @feross shares what went wrong and how to stay secure. YT: buff.ly/Rkyi9Sc Apple: buff.ly/N7b6FAD Spotify: buff.ly/MnjihMK

0 5 9 2K 0

Download Video

Ax Sharma @Ax_Sharma

6 days ago

We’ve seen QR codes in scams before, but those relied on people scanning them. @SocketSecurity's new find is scarier: malware using QR codes to talk to its C2 server — traffic that to security tools looks like harmless image exchanges. bleepingcomputer.com/news/security/…

2 3 16 2K 7

Socket @SocketSecurity

a week ago

⚡️ Follow us on Instagram! instagram.com/socketsecurity/

0 2 3 1K 0

Download Image

Giuseppe @giuseppegurgone

2 weeks ago

given the increasing amount of supply chain attacks you should npm i -g socket and add the following aliases

1 5 16 4K 10

Download Image

Feross @feross

2 weeks ago

We won't rest until everyone can install software safely

Zoltan Kochan @ZoltanKochan

2 weeks ago

We won't rest until everyone can install software safely

0 6 19 9K 0

2 7 63 7K 2

Sean Wright @SeanWrightSec

2 weeks ago

@SocketSecurity has the most comprehensive list that I’ve seen so far for the compromised packages on NPM as a result of the Shai-Hulud worm

Feross @feross

2 weeks ago

@SocketSecurity has the most comprehensive list that I’ve seen so far for the compromised packages on NPM as a result of the Shai-Hulud worm

2 5 31 9K 16

0 3 5 3K 2

Feross @feross

2 weeks ago

🤔

ThePrimeagen @ThePrimeagen

2 weeks ago

🤔 https://t.co/6cpq4lMTBg

152 107 2K 167K 66

23 65 1K 65K 100

Download Image

alain.linea.eth @Alain_Ncls

2 weeks ago

The gift that keeps on giving... Please devs, be extra cautious. Pin your dependency versions, look into Lavamoat (cc @naugtur), try @SocketSecurity. It’s a protection for our end users, but also for our own projects and our own keys. Stay safu 🙏

Feross @feross

2 weeks ago

76 304 2K 587K 451

3 4 26 4K 2

poul.dev @iampoul

2 weeks ago

@feross This is why I endorse socket.dev at our company 🤙

0 2 3 2K 1

Socket @SocketSecurity

2 weeks ago

Today we’re publishing research on 80 confirmed fraudulent candidates who applied for Socket engineering roles in the past 2 months. They’re part of a coordinated campaign, including suspected North Korean operators, aiming to infiltrate hiring pipelines. socket.dev/blog/fraudulen…

0 12 28 3K 4

Feross @feross

2 weeks ago

Should npm require Face ID or Touch ID (i.e. a passkey) in order to run `npm publish`?

18 3 11 5K 1

Feross @feross

2 weeks ago

🚨 The list of malicious npm packages in this attack has grown to 500 🚨 Follow the thread below for the latest in this developing story...

Feross @feross

2 weeks ago

🚨 The list of malicious npm packages in this attack has grown to 500 🚨 Follow the thread below for the latest in this developing story...

9 56 300 104K 69

3 13 87 17K 26

Matt Johansen @mattjay

2 weeks ago

Video featuring @0xTib3rius @lintile and of course @SocketSecurity youtu.be/vuPLmzKUIlc

0 6 20 7K 15

Feross @feross

2 weeks ago

We detect 1,000 supply chain attacks *weekly* across npm, PyPI, Rubygems, Cargo, Go, Maven, and Nuget.

zeØ_Øn256 @zeon256

2 weeks ago

We detect 1,000 supply chain attacks *weekly* across npm, PyPI, Rubygems, Cargo, Go, Maven, and Nuget.

0 0 2 10K 0

2 13 96 10K 13

Feross @feross

2 weeks ago

. @pnpmjs is a strong option for protecting against supply chain attacks, and the DX is excellent too they removed postinstall scripts a while back, cutting one big attack path now they’ve introduced `minimumReleaseAge` which lets you hold off on new versions for a day or more