feross
Re:Critical Next.js RCE Still Missing from GitHub Advisory Database an...
on Saturday September 05, 2026 @12:17AM (#49573028)
Thanks for pointing this out. Socket is building our own vulnerability database to reduce dependence on the increasingly unreliable GHSA database.
Malicious Chrome VPN Extensions Discovered That Do Traffic Redirection
Re:I got into YC (Startup School) by hacking it
on Saturday July 25, 2026 @01:12PM (#49049433)
Founder/CEO of Socket here.
If you have a suggestion for how to scope down the permissions of our app, we’re all ears. But based on our research, it’s not possible.
More info documenting each permission: https://docs.socket.dev/docs/permissions
PyPI Fixes High-Severity Access Control Issues Found in Security Audit
Re:Localsend: An open-source cross-platform alternative to AirDrop
on Wednesday April 29, 2026 @06:48AM (#47946521)
Thanks for the mention!
Axios Maintainer Confirms Social Engineering Attack Behind NPM Compromise
The Hidden Blast Radius of the Axios Compromise
Trivy Supply Chain Attack Expands to Compromised Docker Images
Re:
on Sunday March 22, 2026 @10:54AM (#47478151)
Lots more technical research about the actual attack and how it worked here: https://socket.dev/blog/trivy-under-attack-again-github-acti...
Disclosure: I’m the founder of Socket.