socket.devarticle

Socket Joins New OpenJS Program to Fund Node.js Security Work

Socket announces it is an inaugural funder of the OpenJS Foundation's new Security Stewardship Program, which pools money to pay both bug bounty researchers and maintainers doing triage, patching, and backporting for Node.js, starting there before expanding across the JS ecosystem. The article frames this against a broader funding crisis: curl suspended its bounty program after AI-generated report floods, GitHub restructured its bounty tiers, Canonical moved Ubuntu kernel updates to weekly releases to keep pace with rising CVE volume, and Node.js paused bounty payouts in April after the Internet Bug Bounty pulled funding, even as HackerOne report volume to the Node.js team spiked 4.6x in one month.