Feross
LightNews LightNews
feross.bsky.social
Feross
@feross.bsky.social
6.9K followers 24 following 130 posts
🧙‍♂️ Mad scientist • ✨ Founder + CEO @Socket.dev (http://socket.dev) •🌲 Stanford lecturer (http://cs253.stanford.edu) • ❤️ Open source at WebTorrent + StandardJS
Posts Replies Media Videos
Pinned
feross.bsky.social
Feross @feross.bsky.social · Nov 19
🚀 Big news for JavaScript teams: Socket now supports Bun and vlt in beta.

You no longer have to choose between innovation and security. Commit a bun.lock or vlt-lock.json and Socket gives you full supply chain protection.
Reposted by Feross
sarahgooding.bsky.social
This is at least the third time dYdX-related packages and infrastructure have been compromised in the past four years. Anyone using the #dYdX protocol or exchange should review their exposure.

cc: @campuscodi.risky.biz @bleepingcomputer.com @coindesk.com @web3isgoinggreat.com
February 7, 2026 at 4:18 PM
Reposted by Feross
sarahgooding.bsky.social
“Every large OSS project is navigating the same tension between enthusiasm for AI and real concern about its impact...Protect your maintainers. They're a rare asset, hard to replace and easy to lose. Any path forward that burns them out isn't a path forward at all.” - @dries.bsky.social
socket.dev Socket @socket.dev · 4d
Anthropic says Claude Opus 4.6 uncovered 500+ high-severity open source vulnerabilities.

What that means for disclosure, patching, and the maintainers at the heart of open source security.

socket.dev/blog/the-nex... #oss
The Next Open Source Security Race: Triage at Machine Speed ...
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
socket.dev
February 7, 2026 at 12:19 AM
Reposted by Feross
sarahgooding.bsky.social
Four legit Open VSX extensions shipped credential-stealing malware after the publisher was compromised. The Eclipse Foundation/Open VSX security team confirmed it was consistent with leaked tokens or other unauthorized publishing access.
socket.dev Socket @socket.dev · 10d
🚨 New research: Threat actors compromised four #OpenVSX extensions, pushed malicious updates that load encrypted malware, evade Russian locales, and fetch C2 instructions via #Solana memos, leading to macOS credential and wallet theft.

Full analysis: socket.dev/blog/glasswo...
GlassWorm Loader Hits Open VSX via Suspected Developer Accou...
Threat actors compromised four oorzc Open VSX extensions with than 22,000 downloads, pushing malicious versions that install a staged loader, evade Ru...
socket.dev
January 31, 2026 at 5:21 PM
Reposted by Feross
sarahgooding.bsky.social
"Security work is emotionally expensive and invisible, and sharing it makes it sustainable." - @ulisesgascon.com

Many thanks to @jddalton.bsky.social, @jordan.har.band, and @ulisesgascon.com for their insights on maintaining Lodash and all the hard work put into reviving the project. 💚
January 31, 2026 at 3:51 AM
Reposted by Feross
sarahgooding.bsky.social
This is exactly the kind of thing people worry about with browser extensions. It looks like an Amazon ad blocker, but quietly hijacks affiliate links in the background. Most people aren’t reading extension source code (and if you are, congrats 🙃), which is why this works.
socket.dev Socket @socket.dev · 14d
Socket’s Threat Research team analyzed a Chrome extension marketed as an Amazon ad blocker that secretly hijacks affiliate links and replaces existing tags with its own.

Full Research → socket.dev/blog/malicio...
Malicious Chrome Extension Performs Hidden Affiliate Hijacki...
A Chrome extension claiming to hide Amazon ads was found secretly hijacking affiliate links, replacing creators’ tags with its own without user consen...
socket.dev
January 27, 2026 at 5:41 PM
Reposted by Feross
wake.st
Seeing @pfrazee.com, @arathorn.net and @feross.bsky.social all within arms reach, almost like some sort of centralization!
January 23, 2026 at 11:29 PM
Reposted by Feross
sarahgooding.bsky.social
“We are just a small single open source project with a small number of active maintainers. It is not in our power to change how all these people and their slop machines work. We need to make moves to ensure our survival and intact mental health.” - @bagder.mastodon.social.ap.brid.gy
socket.dev Socket @socket.dev · 18d
curl maintainer @daniel.haxx.se said the project is shutting down its bug bounty program after maintainers were buried under low-quality, AI-generated slop reports. Security disclosure systems that assume unlimited #OSS maintainer labor are reaching their limits.

socket.dev/blog/curl-sh...
curl Shuts Down Bug Bounty Program After Flood of AI Slop Re...
A surge of AI-generated vulnerability reports has pushed open source maintainers to rethink bug bounties and tighten security disclosure processes.
socket.dev
January 24, 2026 at 3:04 AM
Reposted by Feross
brianleroux.bsky.social
only took a decade longer than anticipated (give or take half a decade)
socket.dev Socket @socket.dev · 20d
🎉 Big #NodeJS news this week: v25.4.0 marks require(esm) as stable. After a gradual rollout and ecosystem testing, it’s now safe to depend on across supported releases.

Huge thanks to @joyeecheung.bsky.social and the many contributors who made this possible! 🙏

socket.dev/blog/node-js...
Node.js 25.4.0 Ships with Stable require(esm) - Socket
Node.js 25.4.0 makes require(esm) stable, formalizing CommonJS and ESM compatibility across supported Node versions.
socket.dev
January 22, 2026 at 6:43 PM
Reposted by Feross
sarahgooding.bsky.social
My colleague @staltz.com and his team are at it again, working magic with UIs to reduce cognitive load and make security information easier to explore. Excited to see this launched! 💜
socket.dev Socket @socket.dev · 19d
The new Alert Details page surfaces more context in one place, with a clearer layout, detected instances, and reachability dependency chains that show how risk flows through your code.

More details → socket.dev/blog/introdu...
Introducing the Alert Details Page: A Better Way to Explore ...
Socket's new Alert Details page is designed to surface more context, with a clearer layout, reachability dependency chains, and structured review.
socket.dev
January 22, 2026 at 6:37 PM
Reposted by Feross
socket.dev
🎉 Big #NodeJS news this week: v25.4.0 marks require(esm) as stable. After a gradual rollout and ecosystem testing, it’s now safe to depend on across supported releases.

Huge thanks to @joyeecheung.bsky.social and the many contributors who made this possible! 🙏

socket.dev/blog/node-js...
Node.js 25.4.0 Ships with Stable require(esm) - Socket
Node.js 25.4.0 makes require(esm) stable, formalizing CommonJS and ESM compatibility across supported Node versions.
socket.dev
January 21, 2026 at 8:12 PM
Reposted by Feross
sarahgooding.bsky.social
Cryptomining malware targeting one of Python’s most widely used math libraries.

@campuscodi.risky.biz @decrypt.co @darkreading.bsky.social @coindesk.com
socket.dev Socket @socket.dev · 20d
🚨 New research: We uncovered a PyPI package impersonating SymPy that delivers cryptomining malware via in-memory execution.

The typosquat reuses SymPy’s branding and pulls ELF payloads at runtime.

Full analysis: socket.dev/blog/pypi-pa... #Python
PyPI Package Impersonates SymPy to Deliver Cryptomining Malw...
Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.
socket.dev
January 21, 2026 at 4:34 PM
Reposted by Feross
helpnetsecurity.com
Fake browser crash alerts turn Chrome extension into enterprise backdoor

📖 Read more: www.helpnetsecurity.com/2026/01/19/f...

#cybersecurity #cybersecuritynews #remoteaccesstrojan #socialengineering @huntress.com @socket.dev
Fake browser crash alerts turn Chrome extension into enterprise backdoor - Help Net Security
The NexShield Chrome extension downloaded a Windows RAT onto domain-joined machines after tricking users with fake browser crash alerts.
www.helpnetsecurity.com
January 19, 2026 at 2:57 PM
Reposted by Feross
robpalmer.bsky.social
📜 A good summary of recent developments around the Temporal API by @sarahgooding.bsky.social

Temporal is the modern replacement for the old JS Date API ✨
January 16, 2026 at 6:13 PM
Reposted by Feross
socket.dev
🎙️ Socket CEO @feross.bsky.social joined host Allie Howe on the Insecure Agents podcast to talk about Certified Patches, supply chain security, and the future of securing AI agents.

Check out the full episode →
socket.dev/blog/insecur...
Insecure Agents Podcast: Certified Patches, Supply Chain Sec...
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.
socket.dev
January 8, 2026 at 10:42 PM
Reposted by Feross
sarahgooding.bsky.social
😭 💔 "I feel like a fucking idiot for somehow being able to build this CSS framework that's taken over the world and it's used by everything and it's super popular, but I can't figure out how to have it make enough money that eight people can work on it." - @adamwathan.com
socket.dev Socket @socket.dev · Jan 8
💔 @tailwindcss.com laid off 75% of its engineering team after revenue dropped 80%, despite being more popular than ever. LLMs are killing documentation traffic, breaking the business model that funds development on many open source projects.

Full story → socket.dev/blog/tailwin... #OSS #CSS
Tailwind CSS Announces 75% Layoffs as LLMs Reshape OSS Busin...
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discov...
socket.dev
January 8, 2026 at 7:51 PM
feross.bsky.social
Strongly recommend this post on npm’s staged publishing change after supply-chain turmoil. npm will roll out staged publishing to add a review step before releases go live after the Shai-Hulud attacks, giving maintainers a chance to catch bad releases.

Read it here: socket.dev/blog/npm-to-...
npm to Implement Staged Publishing After Turbulent Shift Off...
The planned feature introduces a review step before releases go live, following the Shai-Hulud attacks and a rocky migration off classic tokens that d...
socket.dev
January 7, 2026 at 7:58 PM
feross.bsky.social
Must-read from Nicholas C. Zakas (ESLint maintainer) on how GitHub could better secure npm and prevent supply-chain attacks. humanwhocodes.com/blog/2026/01...
How GitHub could secure npm - Human Who Codes
Why doesn't npm detect compromised packages the way credit card companies detect fraud?
humanwhocodes.com
January 7, 2026 at 7:55 PM
Reposted by Feross
sarahgooding.bsky.social
· @npmjs.bsky.social appears to be massively under-resourced for the scale of the registry it operates. My respect to the teams keeping it running through wave after wave of supply chain attacks.
socket.dev Socket @socket.dev · Jan 7
npm is planning to implement staged publishing, adding a review step before packages go live.

It follows a year of supply chain attacks & a rocky shift away from classic tokens over the past month that left many maintainers struggling.

socket.dev/blog/npm-to-... #NodeJS cc: @campuscodi.risky.biz
npm to Implement Staged Publishing After Turbulent Shift Off...
The planned feature introduces a review step before releases go live, following the Shai-Hulud attacks and a rocky migration off classic tokens that d...
socket.dev
January 7, 2026 at 6:25 PM
Reposted by Feross
socket.dev
🤖⚔️ Battle of the Bots:

Dependabot opens a PR. Socket flags it as malicious.

Socket CEO @feross.bsky.social discusses dependency risk and update timing, on @softwaredaily.bsky.social.

Full episode → socket.dev/blog/softwar...
January 6, 2026 at 10:23 PM
Reposted by Feross
socket.dev
🎙️ In this episode of @softwaredaily.bsky.social, Socket CEO @feross.bsky.social discusses #OSS maintainer burnout.

“I put this code online as a gift to the world. I didn’t promise it would never have a defect.”

Full episode → socket.dev/blog/softwar... #OpenSource
January 6, 2026 at 6:02 PM
Reposted by Feross
socket.dev
🚨 New research: A spearphishing campaign published 27 malicious npm packages that host browser-run lures mimicking document portals and Microsoft sign-in to steal credentials. This operation targets manufacturing and healthcare orgs in the U.S. and allied countries.

socket.dev/blog/spearph...
Spearphishing Campaign Abuses npm Registry to Target U.S. an...
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, ta...
socket.dev
December 23, 2025 at 7:47 PM
Reposted by Feross
sarahgooding.bsky.social
Another example of attackers abusing npm as infrastructure. Our threat research team found a spearphishing campaign that published 27 malicious packages to host browser-run phishing pages.

cc: @campuscodi.risky.biz @cisoseries.bsky.social @zackwhittaker.com
socket.dev Socket @socket.dev · Dec 23
🚨 New research: A spearphishing campaign published 27 malicious npm packages that host browser-run lures mimicking document portals and Microsoft sign-in to steal credentials. This operation targets manufacturing and healthcare orgs in the U.S. and allied countries.

socket.dev/blog/spearph...
Spearphishing Campaign Abuses npm Registry to Target U.S. an...
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, ta...
socket.dev
December 23, 2025 at 8:32 PM
Reposted by Feross
fatih.6nok.org
Don’t trust free VPNs, don’t install joke Chrome extensions. You know what, just don’t install anything at all from now on. And get a new PC.
socket.dev Socket @socket.dev · Dec 22
🚨 Socket’s Threat Research Team uncovered two malicious "Phantom Shuttle" Chrome extensions masquerading as a VPN since at least 2017, intercepting traffic and exfiltrating credentials via attacker-controlled proxies.

Full research → socket.dev/blog/malicio...
Malicious Chrome Extensions “Phantom Shuttle” Masquerade as ...
Fake “Phantom Shuttle” VPN Chrome extensions (active since 2017) hijack proxy auth to intercept traffic and continuously exfiltrate user credentials t...
socket.dev
December 23, 2025 at 5:43 AM
Reposted by Feross
socket.dev
🚨 Socket’s Threat Research Team uncovered two malicious "Phantom Shuttle" Chrome extensions masquerading as a VPN since at least 2017, intercepting traffic and exfiltrating credentials via attacker-controlled proxies.

Full research → socket.dev/blog/malicio...
Malicious Chrome Extensions “Phantom Shuttle” Masquerade as ...
Fake “Phantom Shuttle” VPN Chrome extensions (active since 2017) hijack proxy auth to intercept traffic and continuously exfiltrate user credentials t...
socket.dev
December 22, 2025 at 9:21 PM
Reposted by Feross
sarahgooding.bsky.social
Chrome extensions are still a wild west ecosystem.

This fake “VPN” ran for years and charged users for the privilege of silently intercepting their traffic.

cc: @campuscodi.risky.biz @zackwhittaker.com @cisoseries.bsky.social
socket.dev Socket @socket.dev · Dec 22
🚨 Socket’s Threat Research Team uncovered two malicious "Phantom Shuttle" Chrome extensions masquerading as a VPN since at least 2017, intercepting traffic and exfiltrating credentials via attacker-controlled proxies.

Full research → socket.dev/blog/malicio...
Malicious Chrome Extensions “Phantom Shuttle” Masquerade as ...
Fake “Phantom Shuttle” VPN Chrome extensions (active since 2017) hijack proxy auth to intercept traffic and continuously exfiltrate user credentials t...
socket.dev
December 22, 2025 at 9:58 PM