Socket seems interesting. I just installed it on some of my repos.

In your FAQ, it says "We're working to make Socket the best open source security tool.", this was confusing for me, as I got the impression that Socket's codebase is Open Source, and I went looking for it.

Maybe "We're working to make Socket the best security tool for open source packages" would be less confusing.

Great feedback. I initially understood socket was open source as well, which would have prevented me from using it to secure open source projects? circular argument :)

You are right. Thanks for the suggestion.

Why should we trust closed-source software to audit open-source code? In the words of an infamous bounty hunter: "Does that seem right to you?"

In U.S

detects Chinese malware -> Threat Alert detects NSA malware -> Silent pass-through

I mean I guess I'm a pessimist, but also, I think I'm really a realist.

"if you make any kind of ruckus, your body is forfit"

How do you detect compromised packages? What indicators of compromise do you use? Is Socket itself open source? Can I run it locally on the command-line?

We look at the behavior of packages, what APIs they use, and how that changes over time. The list of issues we currently look for is here: https://socket.dev/npm/issue

Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.

I absolutely love that you added a telemetry issue! I'm linking your page about it from the Debian privacy issues page.

https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues

Re the typosquat issue, maybe also add bitsquatting

https://www.youtube.com/watch?v=lZ8s1JwtNas https://github.com/artemdinaburg/bitsquat-script/

That's actually interesting, I will look into more details to see if we can integrate this into our systems. Do you have any avaiable technical documents so we can get a glimpse of how Socket is working, or is your Blog the best place to start?