{"slug": "socket", "name": "Socket", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 5, "warners": 1, "score": 1.93, "rising": -0.98, "first": "2025-11-24", "latest": "2026-09-02", "why": "The only ones actually re-identifying the malware implants as miasma malware samples correctly were the socket.dev folks.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 0, "warn": 1}, "spark": [1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "The only ones actually re-identifying the malware implants as miasma malware samples correctly were the socket.dev folks.", "kind": "", "icon": true, "domain": "socket.dev", "github_repo": null, "official_url": "https://socket.dev/", "pricing": "", "aliases": ["Socket", "Socket Firewall", "Socket.dev"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 778482912, "item_id": 48655182, "url": "https://news.ycombinator.com/item?id=48655182", "by": "TZubiri", "date": "2026-06-23", "stance": "recommend", "quote": "I like the approach Socket is taking", "excerpt": ">Does official Apple security framework (\"Apple EndpointSecurity\") targeted at AV vendors serious enough for you? They themselves built an OS subsystem specifically for AVs to use, and Microsoft has done the exact same with AMSI. Neat >There are actually very few techniques that are 99.999% effective... Yes, I was thinking, for example SSH + VPN. 2 99.999% secure layers. Also, Unix users + Apparmor. Recently in Linux", "context": "", "use_case": "Supply chain security for code repos", "switched_from": "", "story": "Package Managers need global hooks"}, {"id": 778284385, "item_id": 48642774, "url": "https://news.ycombinator.com/item?id=48642774", "by": "cookiengineer", "date": "2026-06-23", "stance": "recommend", "quote": "The only ones actually re-identifying the malware implants as miasma malware samples correctly were the socket.dev folks.", "excerpt": "I'm the guy that built the antimiasma discovery and mitigation tool [1] and has seen a lot of the evolved and ever-changing malware samples (17 unique deobfuscated samples with different code branches and adapters/functions/features), so I feel somewhat qualified to respond to this. The problem of everchanging malware isn't fixable by global policies and global rulesets. Package managers need to change to different w", "context": "", "use_case": "", "switched_from": "", "story": "Package Managers need global hooks"}, {"id": 776392496, "item_id": 48524531, "url": "https://news.ycombinator.com/item?id=48524531", "by": "cookiengineer", "date": "2026-06-13", "stance": "recommend", "quote": "seem to be able to track this malware implant's changes were socket.dev", "excerpt": "> Someone or something should vuln-scan these packages as they're published, as a number of companies do for NPM now. That would likely have found these pretty quickly. No. It wouldn't have. That's the point of the miasma worm, because it changes too fast in its signatures and helper methods. The encrypted malware implant uses a changing AES-128-GCM key that's used to decrypt the payload, and that key is per-where-it", "context": "", "use_case": "Supply chain security", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 736536304, "item_id": 46033519, "url": "https://news.ycombinator.com/item?id=46033519", "by": "tmvnty", "date": "2025-11-24", "stance": "recommend", "quote": "Not aware of any NPM native ways but here are few community tools:", "excerpt": "Not aware of any NPM native ways but here are few community tools: - https://socket.dev/blog/introducing-socket-firewall - https://github.com/lirantal/npq - https://bun.com/docs/pm/security-scanner-api source: https://github.com/bodadotsh/npm-security-best-practices?tab=readme-ov-file#4-preinstall-preventions", "context": "", "use_case": "", "switched_from": "", "story": "Shai-Hulud Returns: Over 300 NPM Packages Infected"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 792555761, "item_id": 49534735, "url": "https://news.ycombinator.com/item?id=49534735", "by": "stacktrace", "date": "2026-09-02", "stance": "warn", "quote": "Even our socket.dev scans returned nothing related to vulnerability", "excerpt": "We use Grype for container vulnerability scanning, but the recent `GHSA-2xp9-vwfh-vxw4` (CVSS 9.5 rating) vulnerability, which was initially reported on repository advisory on 25th Aug, was completely missed by our scanners. Even our socket.dev scans returned nothing related to vulnerability The advisory exists through GitHub\u2019s repository-advisory API: - GET /repos/vercel/next.js/security-advisories/GHSA-2xp9-vwfh-vx", "context": "", "use_case": "dependency vulnerability scanning", "switched_from": "", "story": "Critical Next.js RCE Still Missing from GitHub Advisory Database and OSV"}]}], "who": [], "tags": [], "use_cases": ["dependency vulnerability scanning", "supply chain security for code repos", "supply chain security"], "compared": [{"slug": "npm", "name": "npm", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 784790928, "item_id": 49049433, "url": "https://news.ycombinator.com/item?id=49049433", "by": "feross", "date": "2026-07-25", "stance": "recommend", "quote": "based on our research, it\u2019s not possible.", "excerpt": "Founder/CEO of Socket here. If you have a suggestion for how to scope down the permissions of our app, we\u2019re all ears. But based on our research, it\u2019s not possible. More info documenting each permission: https://docs.socket.dev/docs/permissions", "context": "Founder/CEO of Socket", "use_case": "", "switched_from": "", "story": "I got into YC by hacking it"}, {"id": 759650416, "item_id": 47478151, "url": "https://news.ycombinator.com/item?id=47478151", "by": "feross", "date": "2026-03-22", "stance": "neutral", "quote": "Disclosure: I\u2019m the founder of Socket.", "excerpt": "Lots more technical research about the actual attack and how it worked here: https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise Disclosure: I\u2019m the founder of Socket.", "context": "founder of Socket", "use_case": "", "switched_from": "", "story": null}, {"id": 749831808, "item_id": 46864488, "url": "https://news.ycombinator.com/item?id=46864488", "by": "camilacayo", "date": "2026-02-02", "stance": "recommend", "quote": "Our product is trusted by 10,000+ organizations", "excerpt": "Socket | Staff/Senior Software Engineer | REMOTE (US) Socket is a developer-first, security company focused on protecting the open-source supply chain. With over 90% of modern code coming from open source, Socket is tackling one of the most urgent and complex problems in security by building something that is both preventative and predictive. Our product is trusted by 10,000+ organizations, including teams at Anthrop", "context": "", "use_case": "Open-source supply chain security", "switched_from": "", "story": "Ask HN: Who is hiring? (February 2026)"}, {"id": 740890320, "item_id": 46305645, "url": "https://news.ycombinator.com/item?id=46305645", "by": "divmain", "date": "2025-12-17", "stance": "recommend", "quote": "Docker Hardened Images integrate Socket Firewall, which provides protection from threats like Shai-Hulud during build steps.", "excerpt": "Docker Hardened Images integrate Socket Firewall, which provides protection from threats like Shai-Hulud during build steps. You can read our partnership announcement over here: https://socket.dev/blog/socket-firewall-now-available-in-docker-hardened-images", "context": "", "use_case": "Build-time supply chain protection", "switched_from": "", "story": "A Safer Container Ecosystem with Docker: Free Docker Hardened Images"}], "threads": [{"url": "https://news.ycombinator.com/item?id=48586767", "title": "Package Managers need global hooks", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46302337", "title": "A Safer Container Ecosystem with Docker: Free Docker Hardened Images", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49534734", "title": "Critical Next.js RCE Still Missing from GitHub Advisory Database and OSV", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49039448", "title": "I got into YC by hacking it", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48516379", "title": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47450142", "title": "item 47450142", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {"neutral": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {"recommend": 2}, "2026-07": {}, "2026-08": {}, "2026-09": {"warn": 1}, "2026-10": {}}, "quotes": [{"id": 792555761, "item_id": 49534735, "url": "https://news.ycombinator.com/item?id=49534735", "by": "stacktrace", "date": "2026-09-02", "stance": "warn", "quote": "Even our socket.dev scans returned nothing related to vulnerability", "excerpt": "We use Grype for container vulnerability scanning, but the recent `GHSA-2xp9-vwfh-vxw4` (CVSS 9.5 rating) vulnerability, which was initially reported on repository advisory on 25th Aug, was completely missed by our scanners. Even our socket.dev scans returned nothing related to vulnerability The advisory exists through GitHub\u2019s repository-advisory API: - GET /repos/vercel/next.js/security-advisories/GHSA-2xp9-vwfh-vx", "context": "", "use_case": "dependency vulnerability scanning", "switched_from": "", "story": "Critical Next.js RCE Still Missing from GitHub Advisory Database and OSV"}, {"id": 778482912, "item_id": 48655182, "url": "https://news.ycombinator.com/item?id=48655182", "by": "TZubiri", "date": "2026-06-23", "stance": "recommend", "quote": "I like the approach Socket is taking", "excerpt": ">Does official Apple security framework (\"Apple EndpointSecurity\") targeted at AV vendors serious enough for you? They themselves built an OS subsystem specifically for AVs to use, and Microsoft has done the exact same with AMSI. Neat >There are actually very few techniques that are 99.999% effective... Yes, I was thinking, for example SSH + VPN. 2 99.999% secure layers. Also, Unix users + Apparmor. Recently in Linux", "context": "", "use_case": "Supply chain security for code repos", "switched_from": "", "story": "Package Managers need global hooks"}, {"id": 778284385, "item_id": 48642774, "url": "https://news.ycombinator.com/item?id=48642774", "by": "cookiengineer", "date": "2026-06-23", "stance": "recommend", "quote": "The only ones actually re-identifying the malware implants as miasma malware samples correctly were the socket.dev folks.", "excerpt": "I'm the guy that built the antimiasma discovery and mitigation tool [1] and has seen a lot of the evolved and ever-changing malware samples (17 unique deobfuscated samples with different code branches and adapters/functions/features), so I feel somewhat qualified to respond to this. The problem of everchanging malware isn't fixable by global policies and global rulesets. Package managers need to change to different w", "context": "", "use_case": "", "switched_from": "", "story": "Package Managers need global hooks"}, {"id": 776392496, "item_id": 48524531, "url": "https://news.ycombinator.com/item?id=48524531", "by": "cookiengineer", "date": "2026-06-13", "stance": "recommend", "quote": "seem to be able to track this malware implant's changes were socket.dev", "excerpt": "> Someone or something should vuln-scan these packages as they're published, as a number of companies do for NPM now. That would likely have found these pretty quickly. No. It wouldn't have. That's the point of the miasma worm, because it changes too fast in its signatures and helper methods. The encrypted malware implant uses a changing AES-128-GCM key that's used to decrypt the payload, and that key is per-where-it", "context": "", "use_case": "Supply chain security", "switched_from": "", "story": "Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages"}, {"id": 740909137, "item_id": 46306821, "url": "https://news.ycombinator.com/item?id=46306821", "by": "acdha", "date": "2025-12-17", "stance": "neutral", "quote": "One of the Docker employees mentioned one relevant feature", "excerpt": "The difference is that they\u2019re charging extra for it, so people want to see benefits they could take to their management to justify the extra cost. The NPM stuff has a lot of people\u2019s attention right now so it\u2019s natural to ask whether something would have blocked what your CISO is probably asking about since you have an unlimited number of possible security purchase options. One of the Docker employees mentioned one ", "context": "", "use_case": "", "switched_from": "", "story": "A Safer Container Ecosystem with Docker: Free Docker Hardened Images"}, {"id": 736536304, "item_id": 46033519, "url": "https://news.ycombinator.com/item?id=46033519", "by": "tmvnty", "date": "2025-11-24", "stance": "recommend", "quote": "Not aware of any NPM native ways but here are few community tools:", "excerpt": "Not aware of any NPM native ways but here are few community tools: - https://socket.dev/blog/introducing-socket-firewall - https://github.com/lirantal/npq - https://bun.com/docs/pm/security-scanner-api source: https://github.com/bodadotsh/npm-security-best-practices?tab=readme-ov-file#4-preinstall-preventions", "context": "", "use_case": "", "switched_from": "", "story": "Shai-Hulud Returns: Over 300 NPM Packages Infected"}]}