Finding bad software extensions at @SocketSecurity (acquired @secureannex) #️⃣ https://xitter.cf/t.co/KGANHVF6BP

Kansas City, MO
Joined May 2008
>junior dev at a mid startup >wednesday morning >just want to push a minor bugfix to our php app today >open laptop, check slack >company group chat is an absolute warzone >CTO typing in all caps about php2shell >fucking php >whatever, server hasn't blown up yet, I just need to get my code in >open gitlab to merge the PR >forced emergency logout because of a critical gitlab security patch release >fucking gitlab >pipeline fails because of some weird regex compiler bug >spend 40 minutes fighting CI/CD >i can just use AI to help debug >fire up opencode >api keys nuked because they were breached >fucking opencode >i’ll just get fresh LLM api keys from our corp proxy, LiteLLM >it won’t connect? It’s down? >look up LiteLLM news: supply chain compromise >fucking litellm >cold sweat forming >slack alert: db connection error >check our database connection >we host on TiDB Cloud >they just announced a security breach, unauthorized access via stolen service account credentials, data copied >fucking tidb cloud >full panic attack incoming >figure fuck it, just ship the container to Railway and go home >open Railway dashboard >bright red banner: "Security Disclosure: Rotate all environment variables immediately. All builds paused." >fucking railway >try to open the app URL in browser to see if anything is even working ⁠>NET::ERR_CERT_AUTHORITY_INVALID⁠ >eMudhra intermediate certificates compromised >4 >instantly untrusted by every major browser >fucking emudhra >stare blankly at mac screen for 10min >random pop-up >restarting in 10min to fix a critical vulnerability >fucking macos >close laptop >leave office >never come back
106
798
66
8,976
257,365
Just used LiteLLM to create my first PHP website. The AI even suggested getting a certificate from eMudhra for HTTPS to protect my login page. The future looks really bright 🥳
144
619
58
10,585
193,174
Full content from our security engineering workshop @BSidesNYC is at seceng.guide/
7
36
236
9,015
And we are hiring generalist security folk (and others)! Come work with us - privy.io/careers
Today is probably a good time to check in on things with @privy_io, which became part of @stripe just over a year ago. Our acquisition was predicated on three factors: stablecoin growth, self-custody as a key enabler of broader global coverage, and rapidly increasing demand for programmable financial infrastructure. As we said at the time, "money has to reside somewhere, and Privy builds the world's best programmable vaults." Since then, the Privy team has executed exceptionally well: assets in Privy wallets have grown ~25x, monthly active developers are up ~3x, revenue is up ~9x, and Privy now facilitates nearly $25B of monthly transaction volume. @tryramp, @Deel, @Klarna, @felixpago, @HyperliquidX, and thousands of other businesses are building embedded banking functionality on Privy. At Stripe, we're deeply integrating Privy into Treasury, @Link, and Connect. In each case, it's accelerating our global expansion, and enabling us to build better functionality faster. (Coming soon: @Link balances.) We're also seeing that Privy's wallet infrastructure is the ideal substrate for agents to transact and earn -- live today with @merit_systems, @orthogonal_sh, @Nevermined_ai, @prlnet, and more. Developers prefer programmable financial infrastructure, but agents need it. We expect that the agentic economy will continue to grow extremely quickly. The Privy team has maintained remarkable product velocity, with major launches this year including deposit addresses, earning on Privy balances, digital asset accounts, custodial wallets, and Stripe's own stablecoin cards. It's also been neat to see how Privy has been accelerated by Stripe, with better onramps, @stablecoin payment rails and licenses, Stripe's fiat capabilities and issuing stack, and integration with @Tempo. Together, we're building one API for holding stablecoin balances and earning yield, moving money in and out of fiat, and orchestrating spend with cards. We still have a lot of work to do, not least in integrating everything across Privy, Bridge, and the rest of Stripe -- there's been so much feature and functionality expansion that we haven't yet had much time to reconcile everything. Overall, though, I'm very happy with how things are going, and excited by where these capabilities are headed. If you're interested in working on the future of stablecoins, agentic payments, and crypto's deployment in the real world, you should get in touch with @sternhenri (now leading all of @StripeCrypto) or others on the team.
3
7
1
60
5,140
Mutability of releases, tags, whatever concept you think it's very overlooked. Most folks take for granted it's just an abstraction for labeling code that gets implemented differently across many different surfaces.
You’d expect a lockfile to make a dependency immutable. But often it doesn’t: a hacked repository can swap in malicious code for the **same package and version**, and most package managers install it anyway. xitter.cf/trailofbits/status/211…
2
896
tuckner retweeted
Holy shit... A random Chinese company purchased CryptoBilis (the authorised Ledger reseller that issued the spy-implanted Ledgers) from its Malaysian ex-owner, then put him under a confidentiality agreement preventing him from disclosing the sale publicly. What a wild attack.
97
292
85
2,109
295,976
🚨 More than 500 GitHub accounts committed credential-stealing Actions workflows to tens of thousands of repositories. Disguised as security audits, the malicious workflows harvest AWS keys, API tokens, and secrets from Git history. Read: thehackernews.com/2026/10/cr…
19
45
2
111
27,533
tuckner retweeted
Update: Socket has identified more than 500 GitHub accounts that committed the malicious GhostAction workflow to tens of thousands of repositories since October 7, including organization-owned repositories reached through compromised contributors.
🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel. Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.
1
10
1
33
3,677
These user account -> GitHub organization pivots are really interesting. If an employee can infect a repository that others use or maintains secrets, it will keep spreading further.
🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel. Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.
3
3
1,465
🚨 16 malicious Firefox extensions posed as Rabby and OKX wallets to steal recovery phrases and private keys. Their code intercepted wallet secrets during import and attempted to send them to attacker-controlled Cloudflare Workers. All 16 have been removed. Read - thehackernews.com/2026/10/16…
7
24
3
96
29,366
tuckner retweeted
Socket found 16 malicious Firefox extensions impersonating @Rabby_io and @okx wallets, built to steal recovery phrases and private keys. All 16 claim to collect no data. The malware sends wallet secrets to attacker-controlled Cloudflare Workers. socket.dev/blog/firefox-cryp…
1
8
15
1,875
tuckner retweeted
🚀 Socket now scans VS Code Marketplace extensions. You can vet every dependency in your app and still get compromised by an extension in your editor. We analyze all 100,000+ extensions in the VS Code Marketplace and their updates for malicious code and risky behaviors.
2
14
1
63
5,544
I am really excited for the first MinuteCon. This is the first year and we want this to be something we run for years to come. Talks often help shape feel and energy of a conference, I am incredibly excited for what folks share. If you have ideas, drop me a DM.
6
12
1,318
It's been one year of our Sprawl meetup! Our 7th event is this Tuesday, with much more planned for later! If you're coming, there's also some @uwu_underground unique tokens to hand out, and Sprawl challenge coins. Website: sprawl.nyc Organized by @withzombies, "OMAR", and I And a huge thanks to all our speakers and hosts! We're always looking for more folks to speak, and event spaces that can host ~100+ people. Let us know if you can help! Below are some new animations I made to play in the background in between talks (quick version, you can see the full thing on the site).
5
14
1
81
4,293
You're telling me my Christmas theme was going to be Glassworm!? Don't just gloss over themes when looking at code extensions. They are no different than any other one when it comes to executing code.
Socket researchers found a GlassWorm-linked VS Code theme cluster: 4 extensions on VS Code Marketplace and 6 on Open VSX. Related themes have thousands of installs. The malware fetches and executes payloads using encrypted loaders and a Solana dead drop. socket.dev/blog/glassworm-vs…
1
15
2,467
‼️BREAKING: An actively exploited unknown critical Citrix NetScaler zero-day has prompted governments and organizations to SHUTDOWN all their devices immediately. We don't know what's exactly going on yet. Stay tuned for more info.
88
664
98
3,940
639,093
Absolutely crazy that these two GitHub Actions which were quarantined could be reactivated with the malware still armed. Many of the these workflows run on a cron without any true repository activity trigging them.
3
8
2,114
HILARIOUS solidity malware directly copied the warning from the real solidity extension
1
9
544