Socket
Named by 75 kept items in this workspace.
50 items name it under tools, 23 under classification.technologies and 2 under classification.key entities.
Search every workspace for Socket. It matches the name as written, so it can find other things that share it.
The items that name it 75
Monitors npm, Open VSX and the VS Code Marketplace, ingests new packages and extensions, and was used to check registry records and ingestion logs for Claude Code 2.1.313, which it never captured.
Published the report by John Tuckner that identified the 319 hijacking extensions and lists them at the bottom of the report
flagged the malicious release 7 minutes after publication
supply chain security researchers who analyzed the malicious releases and named the known-good versions
reported sweeps including decade-dormant repositories on October 8; report cited
Security platform/AI scanner that analyzed and detected the GhostAction cloud-credentials wave, flagging suspicious behavior in the malicious workflow files.
Security scanning service that analyzes VS Code Marketplace and Open VSX extensions for malicious code, hidden capabilities, and supply chain threats by examining code, activation patterns, dependencies, and capabilities (file system access, network activity, process execution, obfuscation, activati
Threat research team/platform that identified and analyzed the malicious extensions, performed ecosystem coverage identifying related extensions, shared infrastructure, code reuse, and publishing patterns
the publisher of the analysis; May analysis covers the payload
blocks malicious packages as curated Security Hub Extended partner
Security research/threat detection service that identified the malicious code in visanduma/nova-two-factor and tracks the PolinRider campaign
Browser extension security platform that detects malware, credential theft, suspicious network activity, and risky updates; now expanded to cover Microsoft Edge extensions in addition to existing Chrome and Firefox coverage, offering analysis of malicious behavior, permissions/access, network activi
supply-chain security scanner referenced as relying on GHSA feed
Security scanning service; scans Open VSX extensions for activation behavior, file system access, native code, network requests, obfuscation, and other risky capabilities, evaluating the actual extension artifact rather than relying on ID-only blocklists.
Security platform providing package search, dependency scanning, SBOM generation, CVE detection, AI-powered malicious package analysis, and reachability analysis for PHP/Composer and other ecosystems
Security research platform/team (Socket Threat Research) that identified, analyzed and reported the 77-extension campaign to Mozilla
Security research company that analyzed Mini Shai-Hulud malware techniques and commented on the Open VSX extension ID reinstatement/namesquatting issue
Referenced as another traditional tool that misses behavioral supply chain attacks
Security research firm that found PolinRider signatures in the compromised Joyfill packages, prompting OSM's deeper investigation.
Discovered/reported the two compromised Joyfill npm beta releases and the earlier roberts/leads PHP package compromise (May).
publishes free Certified Patches for high-severity vulnerabilities, including for non-customers
supply chain security service that reviewed the 18 npm candidate names, removing 6 false positives, and identified the Ember.js virtual-module false-positive class
Security research firm/platform that investigated and reported Operation Muck and Load, publishing findings and IOCs.
Supply-chain security research/detection service that identified the compromised jscrambler package 6 minutes after publication
Reputation-based supply-chain security scanning tool whose package-age risk scoring was defeated via version backfilling
Detected the malicious @injectivelabs/sdk-ts@1.20.21 release and flagged it with a known-malware alert in its package view
Security team that, with OpenSourceMalware, observed PolinRider publishing payloads to multiple package registries including Packagist and Go.
Threat research team that identified and tracks the PolinRider campaign; maintains dedicated tracking page for affected artifacts (https://socket.dev/supply-chain-attacks/polinrider)
Security research/threat research platform (Socket's Threat Research Team) that analyzed the malicious Chrome and Firefox VPN extensions and published this write-up.
Threat research and supply chain security monitoring; source of this report tracking the Miasma campaign
Security research/reporting service cited for reporting 639 compromised npm packages in one coordinated attack
Referenced as another researcher/organization (along with 'Kedo') that identifies and gets malicious npm payloads taken down.
supply chain security service that detected and flagged the malicious easy-day-js package within six minutes of publication, automatically blocking installs of compromised packages for its customers
Security scanning platform for application repositories; now detects missing lockfiles via Manifest Alerts alongside existing Dependency Alerts, provides alert drawer with impact, remediation, and about details, and can create tickets in connected Jira or Linear
Existing Socket Firewall protection for package manager traffic across ecosystems such as npm, PyPI, Go, and Maven.
reviewed public npm registry metadata to investigate the incident and reported no public evidence of package compromise
Commercial package firewall/supply-chain security product
One of three external scanners integrated into skills.sh; bypassed
Threat feed / AI scanner that detected the malicious node-ipc versions within roughly three minutes of publication and classified the activity as malware; source of this incident response analysis.
Security research/detection platform that identified the TrapDoor campaign through behavioral and cross-registry analysis; detected releases in an average of 5 minutes 56 seconds (median 5 minutes 27 seconds, fastest 58 seconds after publication) across 381 package-version records; reported maliciou
Security platform that replicates and analyzes open source packages across npm, PyPI, Go, and Rust in real time to detect and report nefarious packages to customers
Security research firm tracking the Mini Shai-Hulud campaign's compromised versions and packages across npm, PyPI, and Composer
Threat research platform that detected and investigated the npm supply chain attack, classified affected versions as known malware, and tracked the Mini Shai-Hulud campaign
External security research firm that first reported the attack
security platform providing Certified Patches, VulnDex advisory data, and dependency/SCA scanning to detect direct and transitive usage of vulnerable packages
Security research/monitoring service tracking the GlassWorm campaign and malicious Open VSX extensions; maintains a dedicated GlassWorm v2 tracking page
Security research firm investigating and reporting the supply chain attack; publishes IOCs and a dedicated tracking page
Security scanner; recentlyPublished alert for package versions published within a configurable window, org-wide across npm, PyPI, Maven, Cargo, RubyGems, NuGet, Go, Conda, OpenVSX.
Security firm that published a report on the campaign, including analysis of guardrails-ai@0.10.1 compromise
All technologies in this workspace.