⚡Securing Software Supply Chains at @SocketSecurity (https://xitter.cf/t.co/rjmrp0fCL0) 🔭 Scientific computing for the web via @stdlibjs (https://xitter.cf/t.co/nJc4oxoUlD)
Sugar Land, TX
Joined October 2010
- Tweets6.9K
- Following1.8K
- Followers1.6K
- Likes4.7K
Pinned Tweet
GraphMaker for easy graph building: describe in English what nodes and edges you want, and it handles the rest via OpenAI's help. Support for trees, DAGs, styling, saving in multiple formats etc. Work in progress, please send @CRGenovese and me feedback!
github.com/isle-project/grap…
GPT-6 Astra is a beast with Blender. I decided to test its limits and tasked it with building me geometry that changes and deforms at runtime, rendered in @threejs . Not the highest-value use of a Sunday evening, but I ended up with a fun little disaster game demo (with sound)
Philipp Burckhardt retweeted
Maintaining critical software now comes with a security burden that has outgrown what any volunteer can reasonably carry.
That's why we're upgrading our open source program from the Team to the Business plan, full protection for maintainers at no cost.
socket.dev/blog/free-busines…
Philipp Burckhardt retweeted
🚨 Update: The jscrambler attacker published four more malicious releases: 8.16.0, 8.17.0, 8.18.0, and 8.20.0 with the same infostealer payload.
In 8.18.0 and 8.20.0, the dropper moved out of preinstall and into package code, bypassing npm install --ignore-scripts.
Jscrambler says an npm publishing credential was compromised. Upgrade to 8.22.0. We've updated our technical analysis.
🚨 BREAKING: Socket has identified a supply chain attack targeting the popular jscrambler npm package.
The compromised [email protected] release uses a malicious preinstall hook to execute hidden Windows, macOS, or Linux binaries during npm install.
Today, Socket detected malicious Namastex.ai npm packages that appear to replicate TeamPCP-style Canister Worm patterns, including exfiltration and self-propagation.
More details on our blog, including recommended actions for defenders against yet another supply chain attack on the npm open-source ecosystem: socket.dev/blog/namastex-npm…
We identified 72 malicious Open VSX extensions linked to the GlassWorm campaign, including many cases where the malware is distributed transitively by being delilvered via covert extension packs. See below for link to our full coverage.
Philipp Burckhardt retweeted
We are starting a research internship program at @SocketSecurity We are particularly interested in PhD students who want to apply their research ideas in the broad space of software supply chain security and simultaneously gain industry experience and real-world impact.⬇️
While we haven't seen major supply chain attacks hitting any of the major open-source ecosystems, the Socket Threat Research Team uncovered some fascinating and creative attack techniques worth sharing:
Stay vigilant and keep those dependencies scanned! Read more about the QR code attack here: socket.dev/blog/malicious-fe…
Philipp Burckhardt retweeted
Hey, you! Want to protect your dev machine from npm malware without changing your workflow?
Try a new tool that transparently isolates npm cli in a docker container. No need to remember to do anything!
Early access:
github.com/lavamoat/kipuka
RT for reach 😉 and help me improve
On the @stdlibjs blog, we just published my take on @METR_Evals's surprising study: AI tools made experienced developers 19% slower (expectation: 40% faster!)🤯
I dive into the why, where AI coding tools actually help, and how I've shifted from handholding AI to async delegation.
Two major npm supply chain discoveries this week from the Socket Research Team highlight a critical gap in traditional security approaches. Both threats would slip past security tools that rely on vulnerability databases or metadata alone.
