Philipp Burckhardt

⚡Securing Software Supply Chains at @SocketSecurity ( Scientific computing for the web via @stdlibjs (

[Philipp Burckhardt @burckhap]

GraphMaker for easy graph building: describe in English what nodes and edges you want, and it handles the rest via OpenAI's help. Support for trees, DAGs, styling, saving in multiple formats etc. Work in progress, please send @CRGenovese and me feedback!

https://t.co/ThoIgCoo0Y

[Philipp Burckhardt @burckhap]

More details on our blog, including recommended actions for defenders against yet another supply chain attack on the npm open-source ecosystem: https://t.co/hl3o0Ic5UY

[Philipp Burckhardt @burckhap]

Today, Socket detected malicious https://t.co/zs2xfdhboT npm packages that appear to replicate TeamPCP-style Canister Worm patterns, including exfiltration and self-propagation.

[Philipp Burckhardt @burckhap]

We identified 72 malicious Open VSX extensions linked to the GlassWorm campaign, including many cases where the malware is distributed transitively by being delilvered via covert extension packs. See below for link to our full coverage.

[Alexandros Kapravelos @kapravel]

We are starting a research internship program at @SocketSecurity We are particularly interested in PhD students who want to apply their research ideas in the broad space of software supply chain security and simultaneously gain industry experience and real-world impact.⬇️

[Philipp Burckhardt @burckhap]

And the malicious Rust crates here https://t.co/wy12bVKrYF

[Philipp Burckhardt @burckhap]

While we haven't seen major supply chain attacks hitting any of the major open-source ecosystems, the Socket Threat Research Team uncovered some fascinating and creative attack techniques worth sharing:

[Philipp Burckhardt @burckhap]

Stay vigilant and keep those dependencies scanned! Read more about the QR code attack here: https://t.co/YXUEek6vJI

[Naugtur 💔🇺🇦 @naugtur]

Hey, you! Want to protect your dev machine from npm malware without changing your workflow?

Try a new tool that transparently isolates npm cli in a docker container. No need to remember to do anything!

Early access:
https://t.co/YQE2zGUneN

RT for reach 😉 and help me improve

[Philipp Burckhardt @burckhap]

Direct link to post: https://t.co/TqoX0ztwv8

[Philipp Burckhardt @burckhap]

On the @stdlibjs blog, we just published my take on @METR_Evals's surprising study: AI tools made experienced developers 19% slower (expectation: 40% faster!)🤯
I dive into the why, where AI coding tools actually help, and how I've shifted from handholding AI to async delegation.

[Philipp Burckhardt @burckhap]

Read more: https://t.co/cosNQNHUCI

[Philipp Burckhardt @burckhap]

Two major npm supply chain discoveries this week from the Socket Research Team highlight a critical gap in traditional security approaches. Both threats would slip past security tools that rely on vulnerability databases or metadata alone.

[Philipp Burckhardt @burckhap]

Undocumented Protestware
We found hidden functionality in 28+ npm packages that disables UI for Russian-language users visiting .ru or .by domains. No CVEs. No advisories. No documentation. Just behavior-based disruption quietly copied into packages and shipped to production.

[Philipp Burckhardt @burckhap]

@typesfast "The Wealth and Poverty of Nations" by David Landes.

[Philipp Burckhardt @burckhap]

These packages, disguised as "the cheapest Cursor API," install backdoors that steal credentials and modify crucial files. In total, sw-cur, sw-cur1, and aiide-cur have been downloaded 3,200+ times before discovery.

Read more on the Socket blog:
https://t.co/s5Y0bV6q4E

[Philipp Burckhardt @burckhap]

Over the last few months, I have been picking up Cursor again after finding it not substantially improving my productivity when I tried it last year. It, and the LLMs powering AI code completions, have gotten so much better that I now really enjoy its agent workflow.

[Philipp Burckhardt @burckhap]

🚨 With vibe coding being on everyone's minds and AI code generations seemingly becoming ubiquitous, it is not surprising that this attracts also malicious actors. Kirill Boychenko just uncovered three malicious npm packages targeting Cursor users on macOS.