Working on LavaMoat - supply chain security for JS. meet.js Poland organizer. Node.js user since v0.8. Addicted to teaching.

Poland
Joined October 2010
Mostly on bluesky nowadays
1
2
387
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
๐Ÿฅ ๐’๐ฉ๐ž๐š๐ค๐ž๐ซ ๐€๐ง๐ง๐จ๐ฎ๐ง๐œ๐ž๐ฆ๐ž๐ง๐ญ๐ŸŽ™๏ธ Thrilled to have @naugtur on the #NodeConf EU 2026 stage! He'll tell us the story of "Getting ahead of supply-chain attacks in 2026". ๐ŸŽŸ๏ธDon't miss it out; secure your tickets nodeconf.eu
1
1
4
343
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
And we made it with the leidendeclaration.ai into the Nature editorial. What a day!
9
28
2
222
14,187
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
ยน๐ŸšจACT IMMEDIATELY๐Ÿšจ We found 2 Chrome extensions with 10M+ combined installations, which allow websites to perform account takeover of any website in your browser One even features in Chrome Web Store's Top 25 Popular Chart BOTH ARE STILL LIVE ๐Ÿงต
8
11
3
32
13,776
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
AI technology is on the rise. So are its applications in industry, science, and society at large. At leidendeclaration.ai we, a group of 16 scientists, including mathematicians, computer scientists, philosophers, and historians, have drafted a declaration calling for action on the challenges posed by the use of artificial intelligence in mathematical research. Over several months, we carefully weighed the promises and risks of introducing AI into research workflows and beyond. The declaration has already been endorsed by international communities, most prominently by the International Mathematical Union, as well as by a large group of mathematicians and other scientists. We invite our colleagues to sign the declaration and support its recommendations on how AI should be adopted in our workflows, and how we should establish and maintain relationships with AI labs and industry. One of its central points is the need to preserve balance, rigor, and sound judgment while acknowledging the extraordinary pace of development in the AI community. We hope this declaration, a deeply human act, will serve as a guiding document for those who recognize the human imperative and the need for governance in scientific discovery, especially mathematical discovery.
9
29
4
117
14,753
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. @ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.
8
48
1
310
19,456
๐Ÿ“ฆSet up staged publishing with approximately 1 click per package lavamoat.github.io/stageclicโ€ฆ Without sharing any of your permissions or exposing access to anything.
1
1
2
147
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
๐Ÿ’ช @SocketSecurity just raised a $60M Series C at a $1B valuation, led by @ThriveCapital. Apparently that's worth a gong. ๐Ÿ””
15
13
1
201
200,809
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
Today is a big day for @SocketSecurity. We just raised a $60M Series C at a $1B valuation, led by @ThriveCapital with participation from @a16z, @AbstractVC, and @CapitalOne Ventures. Total funding is now $125M. Four years ago, we started Socket because open source dependencies were flowing into production faster than anyone could vet them. AI has massively accelerated that. Code is being written, shipped, and deployed before any human reads it. Security has to operate at that same speed. One data point from Thrive's diligence that I keep coming back to: they first discovered Socket because @cursor_ai, @OpenAI, and @AnthropicAI all independently told them it was the most important security tool they'd adopted for AI-driven development. Three of the most sophisticated AI companies converging on the same vendor unprompted. Since our Series B, Socket has grown to more than 20,000 organizations, protecting over 1.5 million repositories and blocking more than 1,000 supply chain attacks every week. The team is now over 100 people. Three out of five FAANG companies are Socket customers. So are the companies building the most ambitious AI products:ย @AnthropicAI, @cursor_ai, @xai, @figma, @vercel, @Replit, @scale_AI, @GustoHQ, @Mercadolibre, and @cribl_io, alongside Fortune 100s in financial services and global media. What we've shipped since the last round: โ€ข Socket Firewall blocks malicious packages at install time, before they reach a developer's laptop or CI pipeline. Free for everyone. โ€ข Reachability analysis via our acquisition of Coana, eliminating 50-80% of irrelevant vulnerability alerts by focusing only on CVEs that are actually exploitable. โ€ข Socket Certified Patches for remediating exploitable CVEs in seconds without waiting on upstream maintainers. โ€ข Coverage extending to browser extensions, editor extensions, MCP servers, and AI tools via our acquisition of @secureannex. When the Axios compromise hit, our detection systems flagged the malicious dependency within six minutes. Within 24 hours, more than 2,000 organizations onboarded to Socket to block it. Where the funding goes: deeper investment in Firewall, massively expanding Certified Patches, moving protection closer to every point of install across the developer toolchain, and new product launches pushing Socket into a category we haven't entered before. We're hiring across engineering, sales, customer success, and threat intel. โค๏ธ Thank you to our customers, investors, and the open-source community for your support. Together, weโ€™re making software safer for everyone.
93
73
54
655
2,683,269
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
TL;DR: - Maintainer controls the unscoped tanstack npm package - README presents it as โ€œTanStack Playerโ€ - Package is not affiliated with TanStack - Maintainer demands $10k from TanStack creator - TanStack files legal docs related to a pending trademark infringement claim - No response from npm on the brand-squatting - Package later ships malware that steals .env files This is another form of abuse OSS maintainers are forced to deal with: brand impersonation, extortion attempts, and platform inaction until users are finally exposed to malware.
๐Ÿšจ A brand-squatting npm package impersonating TanStack shipped malicious versions that exfiltrate environment variables from developersโ€™ machines during install. We spoke to @tannerlinsley, creator of @tan_stack, who confirmed that the maintainer of the unscoped tanstack package is not associated with TanStack or the official @tanstack/* projects in any way. The package is unrelated to the project's official CLI, and represents an ongoing brandjacking issue. He also said TanStack has filed legal documents related to a pending trademark infringement claim against the maintainer, that the maintainer previously demanded $10,000 from him, and that TanStack has repeatedly tried, unsuccessfully, to get @npmjs to address the situation.
3
26
283
28,927
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
๐Ÿšจ A brand-squatting npm package impersonating TanStack shipped malicious versions that exfiltrate environment variables from developersโ€™ machines during install. We spoke to @tannerlinsley, creator of @tan_stack, who confirmed that the maintainer of the unscoped tanstack package is not associated with TanStack or the official @tanstack/* projects in any way. The package is unrelated to the project's official CLI, and represents an ongoing brandjacking issue. He also said TanStack has filed legal documents related to a pending trademark infringement claim against the maintainer, that the maintainer previously demanded $10,000 from him, and that TanStack has repeatedly tried, unsuccessfully, to get @npmjs to address the situation.
14
73
10
409
162,989
If I gave @medikoo a penny every time the choice of # as a folder name in es5-ext package caused weird issues for me, I'd be 2 pennies poorer ๐Ÿคฃ
1
151
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
This guy is a fraud. Telegram messages stay unencrypted on their servers all the time. 99%. (Well, encrypted with a hot key they know and use). Easy proof - turn off your phone. Login on another device. Magic, your messages are there! Where do they come from?
WhatsAppโ€™s โ€œE2E encryption by defaultโ€ claim is a giant consumer fraud: ~95% of private messages on WhatsApp end up in plain-text backups on Apple/Google servers โ€” not E2E-encrypted. Backup encryption is optional, and few people enable it โ€” let alone use strong passwords.
186
206
23
4,790
1,495,810
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
In order to get elected, @BarackObama will start a war with Iran.
8,825
69,027
33,235
108,862
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
1/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions. I spent long hours going through all of it, none of which has ever been publicly released. It revealed an intricate ~$1M/month scheme of fraudulent identities, forged legal documents, and crypto-to-fiat conversion. Enjoy the findings!
330
856
113
5,954
1,133,818
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
The biggest story in the world right now is that the president of the United States is a demented old man who takes pleasure in torturing and killing people and is committing crimes with impunity. And yet most legacy media outlets are too cowardly to tell it like it is.
822
11,388
273
46,881
813,411
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
Here is a video of a North Korean IT worker being stopped dead in their tracks upon being required to insult Kim Jong Un. It won't work forever, but right now it's genuinely an effective filter. I'm yet to come across one who can say it.
I would be interested in seeing data that supports the idea that DPRK workers are stopped dead in their tracks upon being required to insult Kim.
310
1,541
354
17,169
3,762,117
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
Replying to @bertcmiller
Projects should adopt LavaMoat @naugtur
1
2
105
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
browsergate.eu/ Remember where you heard this first ๐Ÿ˜‡
Is it common knowledge that @LinkedIn are (probably) AB checking for the existence of over 1K potentially installed web extensions that work on top of them by blasting requests to web resources those make public (allegedly)? github.com/weizman/linkedin-โ€ฆ
1
7
1,957
Naugtur ๐Ÿ’”๐Ÿ‡บ๐Ÿ‡ฆ retweeted
Some more packages @liran_tal may have missed: - everyone - everything - @everything/everywhere - everybody - your-coffee-machine - your-mama - your-soul - your-childhood-memories - every-aspect-of-your-life Make sure to upgrade or remove
๐Ÿšจ Among the packages that rely on axios: - auth0 - alchemy-sdk - @tavily/core - @slack/web-api - aws-crt - contentful-management - @coinbase/cdp-sdk - postmark - @sap-cloud-sdk/core - fastmcp - mcp-proxy - swagger-client - wagmi - gatsby - wait-on - posthog-node
3
2
15
4,128