⚡️ Founder CEO @SocketSecurity (socket.dev) • 🌲 Visiting lecturer @Stanford (cs253.stanford.edu) • ❤️ Open source @WebTorrentApp @StandardJS
Joined August 2008
- Tweets 28,813
- Following 1,652
- Followers 41,309
- Likes 37,111
1,847 Photos and videos
🚨 Active supply chain attack spanning npm, PyPI, and Crates.io simultaneously.
Socket is tracking a campaign we’re calling TrapDoor: 34 malicious packages and 384 versions designed to steal crypto wallets, SSH keys, AWS credentials, GitHub tokens, browser data, and environment variables from developers.
We had a median detection time of 5 minutes and 27 seconds. Fastest detection was 58 seconds after publication.
The packages target crypto, DeFi, Solana, Sui/Move, and AI developers. Names like crypto-credential-scanner, solidity-deploy-guard, sui-move-build-helper, and prompt-engineering-toolkit are crafted to look like legitimate dev tools.
Each ecosystem uses a different execution path:
• npm: postinstall hooks run trap-core.js, a 1,149-line credential harvester that validates stolen AWS/GitHub tokens via API calls and attempts SSH-based lateral movement
• PyPI: packages auto-execute on import, download JavaScript from an attacker-controlled GitHub Pages domain, and run it via node -e
• Crates.io: malicious build.rs scripts search for wallet keystores, XOR-encrypt them, and exfiltrate to GitHub Gists
What makes this campaign especially notable: the npm payload plants persistence through .cursorrules and CLAUDE.md files using zero-width Unicode characters, attempting to trick AI coding assistants into running “security scans” that exfiltrate secrets. The attacker also opened PRs against major AI projects (LangChain, LlamaIndex, MetaGPT, OpenHands, browser-use) trying to inject these files into codebases directly.
If you work in crypto, DeFi, or AI tooling: audit your lockfiles, check for any of the listed packages, and review your project for unexpected .cursorrules or CLAUDE.md files.
Full list of IOCs and affected packages: socket.dev/blog/trapdoor-cry…
8
29
147
32,672
Feross retweeted
Jun 12
A new Mini Shai-Hulud “Hades” variant has infected 23 PyPI package versions, targeting developers with malware designed to steal tokens, keys and cloud credentials, according to @SocketSecurity. #cybersecurity #CISO #infosec bit.ly/3QxsqEQ
1
4
9
2,050
Feross retweeted
Jun 13
The US government forced Anthropic to pull Claude Fable on Friday night, days after launch.
Users spent the week one-shotting code reviews and migrations. Some upgraded specifically for Fable. Now they’re demanding refunds.
Government intervention can now reach directly into a commercial AI product and pull it from the market.
socket.dev/blog/us-governmen…
4
15
103
24,071
🚀
Jun 10
Introducing @PoeticHQ: a new AI system that executes complex multi-hour tasks with 99% accuracy and 10x fewer tokens than agents.
We raised $50M at $500M from Kleiner Perkins, Founders Fund, First Harmonic, and Genius Ventures to build AI that does complex work inside Fortune 500 companies without hallucination.
While code is too brittle, agents are too unpredictable. The work that runs the global economy - anti-money laundering, fraud investigations, underwriting - needs extreme accuracy.
So we built a new kind of software that pairs the flexibility of AI with the predictability of code.
When the world stays the same, Poetic runs fixed code: fast, cheap, identical every time. When the world changes, Poetic uses AI to regenerate its approach and find its way back to the objective.
In one year, we went from zero to an eight-figure run rate as a team of four.
Since then, we’ve scaled the team and executed the highest-stakes processes at AIG, SoFi, and Chime. At SoFi, a large US bank, Poetic reached 99% quality on fraud investigations in five weeks.
1
10
2,943
Unprecedented
Jun 13
The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.
The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.
Access to all other Claude models is not affected.
We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.
Read our full statement: anthropic.com/news/fable-myt…
1
24
1,815
Feross retweeted
Jun 12
🧩 New Research: 152 Chrome "live wallpaper" extensions hid ad tracking behind false privacy disclosures and faked Google search traffic to support ad monetization.
The network spanned 38 publisher accounts, 3 backend brands, and ~105K installs.
socket.dev/blog/152-chrome-l…
1
7
26
2,355
Feross retweeted
Jun 10
Fascinating and clever.
Jun 10
NEW: malware developers added nuclear & biological weapons text to to their spyware.
Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.
Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.
When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.
We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.
In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.
H/T to colleagues that shared this with me socket.dev/blog/mini-shai-hu…
16
30
832
175,265
Feross retweeted
Jun 10
NEW: malware developers added nuclear & biological weapons text to to their spyware.
Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.
Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.
When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.
We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.
In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.
H/T to colleagues that shared this with me socket.dev/blog/mini-shai-hu…
226
2,152
12,627
1,539,959
Feross retweeted
Jun 10
🔥 Socket Firewall is now built into @Replit's AI-powered development experience.
It’s already blocking 8K malicious packages/day across builders on the platform, giving Replit users stronger protection by default the moment dependencies are introduced.
socket.dev/blog/socket-partn…
1
8
50
9,267
Package Firewall is now enabled by default for every builder on Replit as part of Replit Auto-Protect
And its already stopping ~8,000 malicious installs per day on Replit
Read more at: replit.com/blog/package-fire…
4
18
3,528
Most people run a security scan for malicious packages before publishing a project
But the risk starts the moment they're installed
Today we're launching Package Firewall, built in partnership with Socket
It blocks malware before it ever reaches your app
10
11
101
27,181
Feross retweeted
Jun 10
Worried about malware, CVEs, slopsquatting, and more?
Not on Replit!
Thanks to our partnership with @SocketSecurity all Replit builders get the same types of protection that we use internally for our engineering team.
Most people run a security scan for malicious packages before publishing a project
But the risk starts the moment they're installed
Today we're launching Package Firewall, built in partnership with Socket
It blocks malware before it ever reaches your app
3
22
4,614
I'm live on @JSJabber to discuss AI security and JavaScript supply chain attacks!
youtube.com/watch?v=XW8EBK0O…
3
5,092
. @AndrewBecherer is joining @SocketSecurity as our first Chief Information Security Officer.
Andrew was @datadoghq's first security hire and led its security program through hypergrowth and IPO. He went on to serve as CISO at @Iterable, founded @StarisHQ to work on security for production AI systems, and most recently was CISO at Sublime Security. He started his career at @iSECPartners working on infrastructure security with hyperscalers.
Hiring our first CISO was always going to be one of the highest-stakes decisions we make. Socket protects more than 27,000 organizations, including enterprises that depend on us to secure the supply chain behind their most important products. The standard we hold ourselves to has to match the standard we help our customers enforce.
Andrew understands the supply chain problem from both sides. He's a defender who's lived through it, and a builder who knows what tools actually help. The environment he's stepping into: AI now writes as much as 90% of code at top engineering organizations. Package hijackings and maintainer compromises that were once a handful of incidents a year now happen weekly.
In Andrew's words: "Every CISO I talk to is trying to figure out how to give their developers the open source ecosystem and the AI tooling they need without inheriting somebody else's malicious package. That's the problem Socket exists to solve."
Welcome, Andrew.
Full post: socket.dev/blog/andrew-beche…
3
1
25
2,994
We're hiring across engineering, product, design, security, and go-to-market: socket.dev/careers
1
3
873
Feross retweeted
Jun 10
it was great partnering with @amasad @stkenned on this, read more about Replit Auto-Protect, and how they are investing in tooling that protects builders by default:
replit.com/blog/package-fire…
3
7
1,156
Feross retweeted
Please stop this madness.
Jun 8
We are now tracking 471 affected artifacts across npm and PyPI in the Mini Shai-Hulud/Miasma/Hades campaign.
The newer PyPI artifacts from this wave have been added to the dedicated campaign tracker.
Full breakdown:
socket.dev/blog/mini-shai-hu…
21
166
1,603
74,964
Feross retweeted
Jun 9
npm accidentally marked a bunch of one-character packages as security holders, including c, i, n, x, several numbers, and even the - package.
The registry confirmed it was a tooling bug and said a rollback is underway.
socket.dev/blog/npm-tooling-…
1
8
26
4,454
Feross retweeted
Jun 9
Jun 8
We are now tracking 471 affected artifacts across npm and PyPI in the Mini Shai-Hulud/Miasma/Hades campaign.
The newer PyPI artifacts from this wave have been added to the dedicated campaign tracker.
Full breakdown:
socket.dev/blog/mini-shai-hu…
20
63
1,120
57,195
Feross retweeted
Jun 8
We are now tracking 471 affected artifacts across npm and PyPI in the Mini Shai-Hulud/Miasma/Hades campaign.
The newer PyPI artifacts from this wave have been added to the dedicated campaign tracker.
Full breakdown:
socket.dev/blog/mini-shai-hu…
6
36
216
190,680