Solutions Engineer @SocketSecurity | ex-Founding Engineer @momentohq 🐵 息子の大ファン🐯
Seattle
Joined September 2022
- Tweets1.9K
- Following545
- Followers394
- Likes5.3K
Pinned Tweet
I joined @SocketSecurity as Sales Engineer, Commercial! Excited to deep dive into software supply chain security and discussions with customers 🎉
SocketにSales Engineerとしてジョインしました！これからまた技術を通してお客様とお話できるのが楽しみです😊
SEチームは成長中です！
興味のある方はぜひDMください🚀
@SocketSecurity is hiring a sales engineer for SMB customers. Most small companies have no security team, and their coding agents pull in dependencies faster than anyone can review them. You'd run demos and POCs.
If that's you, apply here or DM me.
jobs.ashbyhq.com/socket/de95…
SocketのリサーチがGizmodoで言及されました。
OSSパッケージはもちろんの事、悪意のあるブラウザ拡張機能も @SocketSecurity は防御します。
gizmodo.jp/article/2611-chro…
Erika N Tharp (サープ恵里花) retweeted
The biggest supply chain attacks of 2025 and 2026 hit legitimate packages during the release, usually on GitHub Actions.
Assume your build job will run something hostile. Keep publish credentials out of it.
New guide from @SocketSecurity:
socket.dev/blog/hardening-gi…
Erika N Tharp (サープ恵里花) retweeted
Socket now protects two of America's three largest automakers.
At one, Socket Firewall blocked every install attempt from August's keyv/cacheable npm worm. October's malicious LiteLLM release never even reached their developers.
Neither needed any cleanup.
Erika N Tharp (サープ恵里花) retweeted
🧊 Composer 2.11 adds dependency cooldowns, joining a growing number of package managers that delay newly published releases to reduce exposure to supply chain attacks.
It's opt-in, with overrides for urgent security fixes.
Details → socket.dev/blog/composer-dep…
Erika N Tharp (サープ恵里花) retweeted
A compromised release pipeline can ship malware through a legitimate package, even when its maintainers wrote no malicious code.
Our new guide covers how to harden GitHub Actions against outside attackers, with attack examples & practical configurations.
socket.dev/blog/hardening-gi…
Erika N Tharp (サープ恵里花) retweeted
There’s a lot of misinformation circulating about Claude Code 2.1.313 following inaccurate initial reports from other sources that have since been wholesale rewritten.
Those reports named Open VSX, npm and Microsoft’s marketplace. Our registry checks found no evidence of publication there. Cursor confirmed distribution through its own marketplace.
Here’s a breakdown of what we verified about distribution and potential exposure:
socket.dev/blog/claude-code-…
Erika N Tharp (サープ恵里花) retweeted
There’s a lot of misinformation circulating about Claude Code 2.1.313 following inaccurate initial reports from other sources that have since been wholesale rewritten.
Here’s a breakdown of what we verified about distribution and potential exposure:
socket.dev/blog/claude-code-…
Erika N Tharp (サープ恵里花) retweeted
Socket now protects five of the Magnificent Seven.
The newest bought Socket for our patented precomputed reachability. We analyze every open source package as it's published, so reachability works from an SBOM alone. In the POC it cut their CVEs needing triage in half.
Erika N Tharp (サープ恵里花) retweeted
An OpenCode user reported a free AI loophole and got a torrent of abuse from people who blamed them for cutting off access. In a bizarre twist, the reporter went from proposing a fix to boasting about running 130 agents through the loophole.
Full story → socket.dev/blog/opencode-fre…
Erika N Tharp (サープ恵里花) retweeted
ALT 13.4M That's how many installs we discovered have had their searches hijacked by 319 hidden browser extensions across a decade of time. These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing.
Erika N Tharp (サープ恵里花) retweeted
Cursor has removed a malicious Claude Code 2.1.313 extension from its marketplace. Despite early reports naming Open VSX and npm, we found no record of that version being published on either registry.
socket.dev/blog/claude-code-…
Erika N Tharp (サープ恵里花) retweeted
Last week's malicious LiteLLM release never reached developers at two @SocketSecurity customers. At a leading AI lab, Firewall blocked it on arrival, then every retry. At a top-3 US automaker, pip never offered it.
No cleanup at either.
socket.dev/blog/litellm-comp…
Erika N Tharp (サープ恵里花) retweeted
A browser extension with no permissions and no code can still see every search you make.
@SocketSecurity found 319 extensions with 13.4M users that just swap the default search engine for the operator's proxy. The proxy decides where each query lands.
socket.dev/blog/searchjacked
Erika N Tharp (サープ恵里花) retweeted
Node.js shipped fixes for 10 vulnerabilities on Oct 21. Anthropic said it found 29,000+ candidate bugs over six months and manually reviewed about 6,000.
Finding bugs is getting cheap. The bottleneck is now remediation. Fund the people who fix them.
socket.dev/blog/openjs-nodej…
Erika N Tharp (サープ恵里花) retweeted
Socket now protects the world's largest company. That makes two of the Fortune 5 and ten of the Fortune 100.
Developers, build servers, and AI agents install packages faster than anyone can review them. Socket checks what each one does before it's installed.
Erika N Tharp (サープ恵里花) retweeted
Socket uncovered malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget to steal recovery phrases and private keys. The fake Phantom wallet also bundled the operator’s backend for automatically draining funds.
socket.dev/blog/firefox-wall…
Erika N Tharp (サープ恵里花) retweeted
Node patched eMudhra and Brotli last week, but updating Node only covered part of the problem. Other applications carried their own copies of Brotli or still trusted the compromised certificates, leaving teams with more software to find and fix.
socket.dev/blog/emudhra-brot…
Erika N Tharp (サープ恵里花) retweeted
【調査レポート（日本語訳）公開のお知らせ】
一昨日投稿しました第三者機関（@nebusecurity）によるセキュリティインシデント調査報告書の日本語訳を、弊社Webサイトにて公開いたしました。
調査結果の詳細については、以下よりご確認いただけます。
pingcap.co.jp/trust-hub/secu…
