Another week, another npm supply chain attack 😢 If you haven't read our post "What's Really Going On Inside Your node_modules Folder?", don't miss it. It's a must read.

socket.dev

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.

Do you know what's really going on in your node_modules folder?

@feross

will help to understand the scope of the supply chain threats against the open source ecosystem, with a focus on npm and JavaScript. #ejs Details👉bit.ly/3LS7ctp Tickets🎫enterjs.de/tickets.php

GIF

read image description

ALT

Socket

@SocketSecurity

Apr 11

Another week, another npm supply chain attack 😢 If you haven't read our post "What's Really Going On Inside Your node_modules Folder?", don't miss it. It's a must read.

socket.dev

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.

Socket

@SocketSecurity

Apr 11

Curious about npm supply chain attacks and what you can do to defend against them? Come see

@feross

speak at

@enterjsconf

to learn about the latest attacker techniques and get concrete tips to secure your code!

Quote Tweet

enterJS

@enterjsconf

· Apr 11

Do you know what's really going on in your node_modules folder? @feross will help to understand the scope of the supply chain threats against the open source ecosystem, with a focus on npm and JavaScript. #ejs Details

bit.ly/3LS7ctp Tickets

enterjs.de/tickets.php

GIF

read image description

ALT

Replying to

Check

and al. Looks amazing.

Topics to follow

Carousel

🎧 New episode of JS Party! 🎧 💬 Making moves on supply chain security 💫 w/

🎙 hosted by

🗃�? tagged #javascript #infosec #npm 💚 jsparty.fm/219

✨ I had a super fun conversation with

, and the

crew! ✨ 🗣 Why does

seem to have more attacks than other ecosystems? 🗣 How are vulnerabilities and malware different? 🗣 How does

@SocketSecurity

work behind-the-scenes? �?�? Listen now!

Quote Tweet

JS Party

@JSPartyFM

· Apr 1

New episode of JS Party!

Making moves on supply chain security

w/ @feross @bcomnes & @MikolaLysenko

hosted by @nicknisi & @b0neskull

tagged #javascript #infosec #npm

jsparty.fm/219

Must listen show! So many insights if you want to deliver secure software with Awesome �?�

@SocketSecurity

�?� project

overcast.fm

Making moves on supply chain security (JS Party #219) — Changelog...

Feross has been working on something big. He joins Chris and Nick, along with guests Bret Comnes and Mik Lysenko to discuss Socket, what it is, and its focus on the security of the JavaScript supply...

🗣�?

: Open-source supply chain attacks 🗒�? Majority of our code is written by volunteers and we trust without reading. 🤔 Malicious code often in npm install scripts, sometimes a typo away from popular package names. ➡�? socket.dev #CascadiaJS

socket.dev

Socket - Secure your JavaScript supply chain

Secure your JavaScript supply chain. Depend on Socket to protect your app from malicious dependencies lurking in your open source supply chain.

Just had a great talk with

@feross

at #nodecongress about NPM security. Go checkout his project

socket.dev

Socket - Secure your JavaScript supply chain

Secure your JavaScript supply chain. Depend on Socket to protect your app from malicious dependencies lurking in your open source supply chain.

Tool for digging up malware in JavaScript libraries:

socket.dev

Socket - Secure your JavaScript supply chain

Secure your JavaScript supply chain. Depend on Socket to protect your app from malicious dependencies lurking in your open source supply chain.

Wonderful talk by

(one of my favourite speakers). You should definitely checkout his socket.dev. Also have you thought of making a cli tool so that we can audit our projects locally? youtu.be/-uAX28hfZcc

socket.dev

Socket - Secure your JavaScript supply chain

Secure your JavaScript supply chain. Depend on Socket to protect your app from malicious dependencies lurking in your open source supply chain.

サプライ�?ェーン攻撃を�?ェック�?��??るサービス�?�?�?�知�?��?�

socket.dev

Socket - Secure your JavaScript supply chain

Secure your JavaScript supply chain. Depend on Socket to protect your app from malicious dependencies lurking in your open source supply chain.

I keep trying to read more about what socket.dev does but I cannot for the life of me stop playing with the interactive bundle visualizer on the home page.

socket.dev

Socket - Secure your JavaScript supply chain

Secure your JavaScript supply chain. Depend on Socket to protect your app from malicious dependencies lurking in your open source supply chain.

Replying to

It’s not sandboxing, but socket.dev is specifically out to reduce supply chain attacks across different languages

socket.dev

Socket - Secure your JavaScript supply chain

Secure your JavaScript supply chain. Depend on Socket to protect your app from malicious dependencies lurking in your open source supply chain.

Fascinating talk by

on supply chain security in JS ecosystems - and the Q&A led by

at #devopsjs

We had a great discussion on

@JSPartyFM

with the

@SocketSecurity

team!

Quote Tweet

JS Party

@JSPartyFM

· Mar 24

Happening now! @b0neskull and @nicknisi talk to @feross, @bcomnes, and @mikolalysenko about @SocketSecurity youtube.com/watch?v=qn1lSU

🎊 Happening now!

and

talk to

, and

about

Making moves on supply chain security (JS Party Live!)

Feross and the team behind Socket Security join Boneskull to continue our discussion around npm and supply chain security. Lots of people complain about the ...

I had a SUPER FUN conversation with the

@PodRocketpod

team. We talked about JavaScript supply chain attacks and why this is such a problem in 2022.

Quote Tweet

podrocketpod

@PodRocketpod

· Mar 22

We talked to @feross about Wormhole last June. Now he joins us to talk about @SocketSecurity, a new security company that protects your most critical apps from supply chain attacks. Apple: apple.co/37EG6XN Spotify: spoti.fi/3qqpoCi Google: bit.ly/36D0x7d

We talked to

about Wormhole last June. Now he joins us to talk about

@SocketSecurity

, a new security company that protects your most critical apps from supply chain attacks. Apple: apple.co/37EG6XN Spotify: spoti.fi/3qqpoCi Google: bit.ly/36D0x7d

Do you know what’s really going on in your node_modules folder?

@feross

will dive into examples of recent supply chain attacks and what concrete steps you can take to protect your team from this emerging threat.

portal.gitnation.org

It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder by Feross Aboukha...

Do you know what’s really going on in your node_modules folder? Software supply chain attacks have exploded over the past 12 months and they’re only accelerating in 2022 and beyond. We’ll dive into...

If you're a JS/TS developer, check this out. Also, the webgl viz deconstructing node_modules is 🔥

Quote Tweet

Feross

@feross

· Mar 1

Exciting news! I'm ready to share the project I've been working on for the past 7 months! Introducing

Socket

Search millions of open source packages

Detect suspicious package updates in real-time

Block software supply chain attacks socket.dev

Show this thread

Excited to be speaking at Nordic.js for the second time! This is gonna be awesome! The JavaScript security space is evolving quickly these days, so there will be lots of new and exciting stuff to talk about by October I’m sure!

Quote Tweet

Nordic.js

@nordicjs

· Mar 18

Give it up for Feross Aboukhadijeh (@feross) who is the Founder and CEO of Socket (@SocketSecurity)

His talk is called “What's Really Going on Inside Your Node_Modules Folder�?. Get your ticket at nordicjs.com/2022/ #nordicjs

Show this thread

What’s Really Going On Inside Your node_modules Folder?, by

@socketsecurity

socket.dev

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.

Give it up for Feross Aboukhadijeh (

@feross

) who is the Founder and CEO of Socket (

@SocketSecurity

) �?�?�? His talk is called “What's Really Going on Inside Your Node_Modules Folder�?. Get your ticket at nordicjs.com/2022/ #nordicjs

Wow, this is a fabulous tool.

Quote Tweet

Feross

@feross

· Mar 1

Exciting news! I'm ready to share the project I've been working on for the past 7 months! Introducing

Socket

Search millions of open source packages

Detect suspicious package updates in real-time

Block software supply chain attacks socket.dev

Show this thread

A great article on #npm #security issues from

@feross

: (and his new awesome, most needed tool

@SocketSecurity

) socket.dev/blog/inside-no Might run "npm install" in a #Docker container as an extra layer between the packages and my machine now. #JavaScript

socket.dev

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.

Socket Retweeted

@undeterrable

Mar 12

Some truly terrifying facts about

@npmjs

in this article by

@SocketSecurity

socket.dev

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.

Introducing Socket [service that detects malicious npm packages via static and dynamic analysis]

@SocketSecurity

socket.dev/blog/introduci ^ar

socket.dev

Introducing Socket - Socket

Socket's mission is to make open source safer.

Socket Retweeted

Luke Mulks | �?Ξ�?◎�?

@lukemulks

Mar 5

💯.

@feross

steps ahead, once again.

Quote Tweet

JD Ross

@justindross

· Mar 2

Software supply-chain attacks are not talked about nearly enough. Socket is really cool and Feross gets this stuff better than anyone twitter.com/feross/status/…

Check out this week's episode of #JavaScriptJabber with

@feross

#JSJ: Supply Chain Security - Part 2 rfr.bz/t3o4wjg rfr.bz/t3o4wjg

Must read for every senior NodeJS developer.. from

@SocketSecurity

. What's Really Going On Inside Your node_modules Folder? - Socket

socket.dev

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.

During his time at SPC,

@feross

epitomized the builder mindset we value so much in members. We're thrilled to see Socket go public and proud to back it!

Quote Tweet

Feross

@feross

· Mar 1

Exciting news! I'm ready to share the project I've been working on for the past 7 months! Introducing

Socket

Search millions of open source packages

Detect suspicious package updates in real-time

Block software supply chain attacks socket.dev

Show this thread

This is really cool. Npm supply chain attacks have become a norm. Totally agree that reactive CVE scanning is missing the point

Quote Tweet

Feross

@feross

· Mar 1

Exciting news! I'm ready to share the project I've been working on for the past 7 months! Introducing

Socket

Search millions of open source packages

Detect suspicious package updates in real-time

Block software supply chain attacks socket.dev

Show this thread

I spent quite a lot of time resolving vulnerabilities (actual or not really exploitable) in my previous job. If you haven't really thought what happens when you install an npm module, you might want to read this post by

@SocketSecurity

socket.dev

What's Really Going On Inside Your node_modules Folder? - Socket

Examples of recent supply chain attacks and concrete steps you can take to protect your team from this emerging threat.