Naugtur ๐๐บ๐ฆ retweeted
๐ฅ ๐๐ฉ๐๐๐ค๐๐ซ ๐๐ง๐ง๐จ๐ฎ๐ง๐๐๐ฆ๐๐ง๐ญ๐๏ธ
Thrilled to have @naugtur on the #NodeConf EU 2026 stage!
He'll tell us the story of "Getting ahead of supply-chain attacks in 2026".
๐๏ธDon't miss it out; secure your tickets nodeconf.eu
Naugtur ๐๐บ๐ฆ retweeted
And we made it with the leidendeclaration.ai into the Nature editorial. What a day!
Naugtur ๐๐บ๐ฆ retweeted
ยน๐จACT IMMEDIATELY๐จ
We found 2 Chrome extensions with 10M+ combined installations, which allow websites to perform account takeover of any website in your browser
One even features in Chrome Web Store's Top 25 Popular Chart
BOTH ARE STILL LIVE ๐งต
Naugtur ๐๐บ๐ฆ retweeted
AI technology is on the rise. So are its applications in industry, science, and society at large. At
leidendeclaration.ai
we, a group of 16 scientists, including mathematicians, computer scientists, philosophers, and historians, have drafted a declaration calling for action on the challenges posed by the use of artificial intelligence in mathematical research.
Over several months, we carefully weighed the promises and risks of introducing AI into research workflows and beyond. The declaration has already been endorsed by international communities, most prominently by the International Mathematical Union, as well as by a large group of mathematicians and other scientists.
We invite our colleagues to sign the declaration and support its recommendations on how AI should be adopted in our workflows, and how we should establish and maintain relationships with AI labs and industry.
One of its central points is the need to preserve balance, rigor, and sound judgment while acknowledging the extraordinary pace of development in the AI community.
We hope this declaration, a deeply human act, will serve as a guiding document for those who recognize the human imperative and the need for governance in scientific discovery, especially mathematical discovery.
The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise.
@ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.
๐ฆSet up staged publishing with approximately 1 click per package
lavamoat.github.io/stageclicโฆ
Without sharing any of your permissions or exposing access to anything.
๐ช @SocketSecurity just raised a $60M Series C at a $1B valuation, led by @ThriveCapital.
Apparently that's worth a gong. ๐
RT @feross: This is exactly why Socket Security built Socket Firewall back in 2023. It's 100% free, and it will block malware from making iโฆ
This quoted post is unavailable.
Today is a big day for @SocketSecurity. We just raised a $60M Series C at a $1B valuation, led by @ThriveCapital with participation from @a16z, @AbstractVC, and @CapitalOne Ventures. Total funding is now $125M.
Four years ago, we started Socket because open source dependencies were flowing into production faster than anyone could vet them. AI has massively accelerated that. Code is being written, shipped, and deployed before any human reads it. Security has to operate at that same speed.
One data point from Thrive's diligence that I keep coming back to: they first discovered Socket because @cursor_ai, @OpenAI, and @AnthropicAI all independently told them it was the most important security tool they'd adopted for AI-driven development. Three of the most sophisticated AI companies converging on the same vendor unprompted.
Since our Series B, Socket has grown to more than 20,000 organizations, protecting over 1.5 million repositories and blocking more than 1,000 supply chain attacks every week. The team is now over 100 people.
Three out of five FAANG companies are Socket customers. So are the companies building the most ambitious AI products:ย @AnthropicAI, @cursor_ai, @xai, @figma, @vercel, @Replit, @scale_AI, @GustoHQ, @Mercadolibre, and @cribl_io, alongside Fortune 100s in financial services and global media.
What we've shipped since the last round:
โข Socket Firewall blocks malicious packages at install time, before they reach a developer's laptop or CI pipeline. Free for everyone.
โข Reachability analysis via our acquisition of Coana, eliminating 50-80% of irrelevant vulnerability alerts by focusing only on CVEs that are actually exploitable.
โข Socket Certified Patches for remediating exploitable CVEs in seconds without waiting on upstream maintainers.
โข Coverage extending to browser extensions, editor extensions, MCP servers, and AI tools via our acquisition of @secureannex.
When the Axios compromise hit, our detection systems flagged the malicious dependency within six minutes. Within 24 hours, more than 2,000 organizations onboarded to Socket to block it.
Where the funding goes: deeper investment in Firewall, massively expanding Certified Patches, moving protection closer to every point of install across the developer toolchain, and new product launches pushing Socket into a category we haven't entered before.
We're hiring across engineering, sales, customer success, and threat intel.
โค๏ธ Thank you to our customers, investors, and the open-source community for your support. Together, weโre making software safer for everyone.
Naugtur ๐๐บ๐ฆ retweeted
TL;DR:
- Maintainer controls the unscoped tanstack npm package
- README presents it as โTanStack Playerโ
- Package is not affiliated with TanStack
- Maintainer demands $10k from TanStack creator
- TanStack files legal docs related to a pending trademark infringement claim
- No response from npm on the brand-squatting
- Package later ships malware that steals .env files
This is another form of abuse OSS maintainers are forced to deal with: brand impersonation, extortion attempts, and platform inaction until users are finally exposed to malware.
๐จ A brand-squatting npm package impersonating TanStack shipped malicious versions that exfiltrate environment variables from developersโ machines during install.
We spoke to @tannerlinsley, creator of @tan_stack, who confirmed that the maintainer of the unscoped tanstack package is not associated with TanStack or the official @tanstack/* projects in any way. The package is unrelated to the project's official CLI, and represents an ongoing brandjacking issue.
He also said TanStack has filed legal documents related to a pending trademark infringement claim against the maintainer, that the maintainer previously demanded $10,000 from him, and that TanStack has repeatedly tried, unsuccessfully, to get @npmjs to address the situation.
Naugtur ๐๐บ๐ฆ retweeted
๐จ A brand-squatting npm package impersonating TanStack shipped malicious versions that exfiltrate environment variables from developersโ machines during install.
We spoke to @tannerlinsley, creator of @tan_stack, who confirmed that the maintainer of the unscoped tanstack package is not associated with TanStack or the official @tanstack/* projects in any way. The package is unrelated to the project's official CLI, and represents an ongoing brandjacking issue.
He also said TanStack has filed legal documents related to a pending trademark infringement claim against the maintainer, that the maintainer previously demanded $10,000 from him, and that TanStack has repeatedly tried, unsuccessfully, to get @npmjs to address the situation.
If I gave @medikoo a penny every time the choice of # as a folder name in es5-ext package caused weird issues for me, I'd be 2 pennies poorer ๐คฃ
Naugtur ๐๐บ๐ฆ retweeted
This guy is a fraud. Telegram messages stay unencrypted on their servers all the time. 99%.
(Well, encrypted with a hot key they know and use).
Easy proof - turn off your phone. Login on another device. Magic, your messages are there! Where do they come from?
Naugtur ๐๐บ๐ฆ retweeted
In order to get elected, @BarackObama will start a war with Iran.
1/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions.
I spent long hours going through all of it, none of which has ever been publicly released.
It revealed an intricate ~$1M/month scheme of fraudulent identities, forged legal documents, and crypto-to-fiat conversion.
Enjoy the findings!
Naugtur ๐๐บ๐ฆ retweeted
The biggest story in the world right now is that the president of the United States is a demented old man who takes pleasure in torturing and killing people and is committing crimes with impunity. And yet most legacy media outlets are too cowardly to tell it like it is.
Naugtur ๐๐บ๐ฆ retweeted
Here is a video of a North Korean IT worker being stopped dead in their tracks upon being required to insult Kim Jong Un.
It won't work forever, but right now it's genuinely an effective filter. I'm yet to come across one who can say it.
Replying to @pcaversaccio @eiritana
I would be interested in seeing data that supports the idea that DPRK workers are stopped dead in their tracks upon being required to insult Kim.
Naugtur ๐๐บ๐ฆ retweeted
browsergate.eu/
Remember where you heard this first ๐
Is it common knowledge that @LinkedIn are (probably) AB checking for the existence of over 1K potentially installed web extensions that work on top of them by blasting requests to web resources those make public (allegedly)?
github.com/weizman/linkedin-โฆ
Naugtur ๐๐บ๐ฆ retweeted
Some more packages @liran_tal may have missed:
- everyone
- everything
- @everything/everywhere
- everybody
- your-coffee-machine
- your-mama
- your-soul
- your-childhood-memories
- every-aspect-of-your-life
Make sure to upgrade or remove
๐จ Among the packages that rely on axios:
- auth0
- alchemy-sdk
- @tavily/core
- @slack/web-api
- aws-crt
- contentful-management
- @coinbase/cdp-sdk
- postmark
- @sap-cloud-sdk/core
- fastmcp
- mcp-proxy
- swagger-client
- wagmi
- gatsby
- wait-on
- posthog-node


























