Socket is the #1 software supply chain security platform. Next-gen SCA + SBOM + 0-day prevention. LOVED BY DEVELOPERS. 👀 @npm_malware

Today is a big day for Socket.
Today is a big day for @SocketSecurity. We just raised a $60M Series C at a $1B valuation, led by @ThriveCapital with participation from @a16z, @AbstractVC, and @CapitalOne Ventures. Total funding is now $125M. Four years ago, we started Socket because open source dependencies were flowing into production faster than anyone could vet them. AI has massively accelerated that. Code is being written, shipped, and deployed before any human reads it. Security has to operate at that same speed. One data point from Thrive's diligence that I keep coming back to: they first discovered Socket because @cursor_ai, @OpenAI, and @AnthropicAI all independently told them it was the most important security tool they'd adopted for AI-driven development. Three of the most sophisticated AI companies converging on the same vendor unprompted. Since our Series B, Socket has grown to more than 20,000 organizations, protecting over 1.5 million repositories and blocking more than 1,000 supply chain attacks every week. The team is now over 100 people. Three out of five FAANG companies are Socket customers. So are the companies building the most ambitious AI products: @AnthropicAI, @cursor_ai, @xai, @figma, @vercel, @Replit, @scale_AI, @GustoHQ, @Mercadolibre, and @cribl_io, alongside Fortune 100s in financial services and global media. What we've shipped since the last round: • Socket Firewall blocks malicious packages at install time, before they reach a developer's laptop or CI pipeline. Free for everyone. • Reachability analysis via our acquisition of Coana, eliminating 50-80% of irrelevant vulnerability alerts by focusing only on CVEs that are actually exploitable. • Socket Certified Patches for remediating exploitable CVEs in seconds without waiting on upstream maintainers. • Coverage extending to browser extensions, editor extensions, MCP servers, and AI tools via our acquisition of @secureannex. When the Axios compromise hit, our detection systems flagged the malicious dependency within six minutes. Within 24 hours, more than 2,000 organizations onboarded to Socket to block it. Where the funding goes: deeper investment in Firewall, massively expanding Certified Patches, moving protection closer to every point of install across the developer toolchain, and new product launches pushing Socket into a category we haven't entered before. We're hiring across engineering, sales, customer success, and threat intel. ❤️ Thank you to our customers, investors, and the open-source community for your support. Together, we’re making software safer for everyone.
5
6
105
37,747
.@vltpkg 1.5.0 links agent skills from your dependencies to coding agents, with versions pinned by your lockfile. The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents. socket.dev/blog/vlt-skills
1
9
1,253
Given that the vlt CLI is a proper package manager, you get all the benefits like a lockfile and automatic filter of undesirable packages using data from our partner @SocketSecurity Read more about this release in our blog post: vlt.io/blog/vlt-skills
1
4
435
🧊 Rust 1.100 will let developers put fresh dependency releases on ice. Cargo’s opt-in cooldowns give researchers and maintainers time to catch malicious crates before more projects pull them in. socket.dev/blog/rust-cargo-c…
1
8
59
4,669
Don't tell Michael Scott the bankruptcy system is down
1
4
1,386
Socket retweeted
Deno spent years persuading developers to bet on a better runtime. Now its creator sees “marginal” gains in a project “sucked into the gravity well of node compatibility.” The backlash, the forks, and how AI is changing the future of JavaScript runtimes. socket.dev/blog/deno-acquisi…
10
24
4,175
The stuff of nightmares. 😵
Anthropic researchers ran a 26-billion-parameter model across fifteen cheap Android TV boxes 🤯
1
3
931
🎙️ @andrewbecherer on the Build vs Buy decision for security teams in the agentic AI era
1
5
8
1,845
Socket retweeted
Replying to @SocketSecurity
@SocketSecurity is hiring! Amazing company!
Top pick of AI companies I would join
3
9
1,297
Anthropic is giving open source maintainers a fast track to Mythos vulnerability findings. Its free OSS Scanner delivers recurring audits, reports showing how to reproduce vulnerabilities, and proposed fixes when available. socket.dev/blog/anthropic-os…
1
3
12
2,738
Anthropic researchers ran a 26-billion-parameter model across fifteen cheap Android TV boxes 🤯
6
8
3,577
Unusual News: @CapitalOne has chosen our portfolio company @SocketSecurity to help secure its open source supply chain, detecting risky dependencies before they enter its environment. Congratulations to the Socket team! Read more: socket.dev/blog/capital-one-…
1
4
811
“It’s never been easier to build a security program. It’s never been harder to secure an organization.” 🗣️ @andrewbecherer & @dannguyenhuu from @DecibelVC
1
2
3
1,715
🚀 Socket for Origin is now available in @cursor_ai’s App Marketplace! Automatically scan dependency changes for malware, compromised updates, and other supply chain risks. Get findings directly on your pull requests, before you merge. socket.dev/blog/socket-for-o…
3
6
1,939
Socket retweeted
More than 500 GitHub accounts... Tens of thousands of repos... GhostAction is back 🔪
1
11
18
2,714
Socket retweeted
Origin, Cursor’s code hosting platform, now supports over 20 integrations. Connect your repos to tools for CI, deployments, code review, security, monitoring, and project management.
155
134
2,104
186,195
Socket retweeted
You see the fifth thing your agent tried. The four before it may have pulled malicious packages, and you'd never know. That's why every input to a software factory needs to be verified. Today we published the Software Factory Reference Architecture, read the paper here: agentbaseline.org/reference-…
5
8
1,129