Andrew Becherer is joining Socket as our first CISO.
He was Datadog's first security hire and led security there through its IPO.
Socket protects 27,000+ orgs. Andrew will own how we protect ourselves and how we show up for the security teams we serve.
socket.dev/blog/andrew-...
🧩 New Research: 152 Chrome "live wallpaper" extensions hid ad tracking behind false privacy disclosures and faked Google search traffic to support ad monetization.
The network spanned 38 publisher accounts, 3 backend brands, and ~105K installs.
socket.dev/blog/152-chr...
Shocked, shocked I say
Feross
OSV has withdrawn 157 malware reports after automated detections incorrectly flagged npm and PyPI packages as malicious, pushing bad records for trusted projects into OSV-consuming security tools and CI/CD systems.
socket.dev/blog/osv-wit...
Open source maintainers were already overloaded. AI-driven vulnerability discovery is about to send a lot more findings their way.
@feross.bsky.social on TBPN 👇
socket.dev/blog/feross-...
New research: A malicious NuGet package impersonating Sicoob’s official SDK exfiltrated client IDs, PFX passwords, and banking certificates through Sentry telemetry.
A fake SDK for stealing API secrets:
socket.dev/blog/malicio...
🚨 Active supply chain attack across npm, PyPI, and Crates.io. 34+ packages stealing crypto wallets, SSH keys, and cloud creds. The malware even plants poisoned .cursorrules and CLAUDE.md files to weaponize AI coding assistants.
socket.dev/blog/trapdoo...
Socket
Socket
Socket
"AI is now driving both the production and consumption of open source software. AI-generated music ends in human ears, and AI-generated images mostly benefit humans, but AI-generated software is an ouroboros (a snake eating its own tail) which is just getting started." - @staltz.com
Socket
socket.dev
Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.
Turn off automatic extension updates in your IDE. Make it the default.
🧩 New Research: 152 Chrome "live wallpaper" extensions hid ad tracking behind false privacy disclosures and faked Google search traffic to support ad monetization.
The network spanned 38 publisher accounts, 3 backend brands, and ~105K installs.
socket.dev/blog/152-chr...
OSV withdrew 157 OSV malware reports after automated false positives incorrectly flagged trusted npm and PyPI packages, sending bad records into tools...
New Research: Trojanized Open VSX extensions are shipping GlassWASM, a new WebAssembly malware variant.
It hides malware logic in TinyGo-compiled WASM and pulls C2 instructions from Solana transaction memos.
socket.dev/blog/glasswa...
Socket
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.
