Feross Aboukhadijeh
Feross Aboukhadijeh is the founder and CEO of Socket, a software supply chain security company that helps organizations detect and block malicious packages in their dependencies. He is also known as the creator of WebTorrent, a popular peer-to-peer streaming torrent client for the web, and has contributed to open-source projects including StandardJS. His company Socket raised a Series B funding round led by Thrive Capital, valuing the company at approximately one billion dollars.
“There's other ecosystems that are volunteer run that don't have the backing of GitHub and Microsoft behind them that are going to probably not make those changes.”
Source→“Just like a human hacker would, they're going to pick the easiest way in, and the lowest hanging fruit now has become just publishing malware to public registries because they know that there's no vetting happening, and developers are likely to install them.”
Source→“There was one of the threat groups actually kind of posted their open-sourced, their kind of vibe-coded toolkit for others to use to be able to do this. We've seen copycat attacks happen since then.”
Source→“About half of our team at Socket are maintainers, half the engineering team. And so we have a lot of connections in the community. And our CTO is the former CTO of NPM.”
Source→“NPM has announced that they are planning to, I think it's in January 2027, going to require human interactive confirmation through 2FA before any new publishers can happen. So that will likely kind of kill this whole worm concept completely.”
Source→“The easiest path into a company... has now become the software supply chain. Just like a human hacker would, they're going to pick the easiest way in, and the lowest hanging fruit now has become just publishing malware to public registries because they know that there's no vetting happening, and the developers are likely to install them.”
Source→“NPM has announced that they are planning to, I think it's in January 2027, going to require human interactive confirmation through 2FA before new publishers can happen. So that will likely kind of kill this whole worm concept completely.”
Source→“Socket ($60M at $1B from Thrive Capital) — security company protecting apps from supply chain attacks.”
AI-extracted from podcast / newsletter / paper summaries. May contain errors.