Feross

@feross

⚡️ Founder + CEO @SocketSecurity (socket.dev) • 🌲 Visiting lecturer @Stanford (cs253.stanford.edu) • ❤️ Open source @WebTorrentApp + @StandardJS

Stanford, CA

feross.org

Joined August 2008

Replies Articles Media

Pinned
Feross
@feross
Aug 4
🚨 Active supply chain attack on npm: keyv and cacheable are compromised right now, and the payload is a worm. The maintainer account behind both package families was compromised. On August 4, ten packages were republished with a malicious preinstall hook that steals your
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
From socket.dev
Feross
@feross
Aug 13
AI agents now choose, install, and run code with developer credentials, often with no human in the loop. 25 years of security infrastructure assumes a human makes those decisions. That assumption is breaking. Malicious packages on public registries: 55K in 2022, nearly 500K in
The Agent Attack Surface: Why AI Is Breaking Software Security As We Know It | Socket
From youtube.com
Feross
@feross
Aug 12
Socket's Business plan is now free for open source projects. Attackers took over a maintainer account and pushed malware into keyv and cacheable, packages with tens of millions of weekly downloads. Maintainers are the attack surface now. Any public OSI-licensed project gets
Free Business Plan Upgrades for Open Source Maintainers
From socket.dev
Feross
@feross
Aug 12
🚨 737 malicious VPN extensions in the Chrome Web Store. 516 are still live with 58,318 installs. They impersonate Proton, NordVPN, and Cloudflare's 1.1.1.1, then route all browser traffic through the operator's proxies. Check yours:
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
From socket.dev
Feross
@feross
Aug 4
🚀 Socket is now available in the AWS Security Hub Extended plan. For AWS customers, that means you can apply committed AWS spend toward @SocketSecurity, move seats up or down month to month, and consolidate billing with the rest of your security stack. The first month is free.
AWS Security Hub Adds Socket for Supply Chain Security
From socket.dev