Darcy Clarke

@vltpkg Founder & Chief End-User Officer

Prev: @GitHub @npmjs Staff EM & @Themify Co-Founder

Proudly 🇨🇦 & investing here...

[Darcy Clarke @darcy]

@rajibmondal_ It's your new favorite package manager

[Darcy Clarke @darcy]

@rough__sea You mean bots right?

[Darcy Clarke @darcy]

If this sounds like you, you should apply on our site: https://t.co/F3eGxlB552

[Darcy Clarke @darcy]

⚡️ We're looking for a DevRel person @vltpkg based in our Toronto 🇨🇦 HQ. You'll work closely w/ me & should love the idea of owning various aspects of product marketing. You'll be vlt's biggest fan & advocate; molding this unique role in a way that plays to your strengths & ours.

[Darcy Clarke @darcy]

Love the work @motdotla is doing with @dotenvx & am excited by what he's doing with Armor ⛨ - Our @vltpkg team got a excited when we first saw that first name change & appreciated Scott's willingness to adapt the name again to ensure there wasn't any confusion. Much love 🖤

[Scott Motte @motdotla]

Update: Renamed again to Armor ⛨.

@darcy and the amazing team behind @vltpkg - many of the same guys instrumental with npm and github - kindly brought up a concern that naming it VLT could confuse the community. It was a good point and really glad they raised it with me. Armor ⛨ it is!

[Scott Motte @motdotla]

Update: Renamed again to Armor ⛨.

@darcy and the amazing team behind @vltpkg - many of the same guys instrumental with npm and github - kindly brought up a concern that naming it VLT could confuse the community. It was a good point and really glad they raised it with me. Armor ⛨ it is!

[Darcy Clarke @darcy]

Notably, I hope this doesn't give the province/feds cover for more real estate bailouts. Government programs, spending & thinking they can employ every Canadian is the problem here.

[Darcy Clarke @darcy]

Not the best way to end Toronto Tech Week that's for sure. I think the boots on the ground have known this for awhile so waiting for technicalities is pretty sad. The bright side is, hard times can create strong people/companies - if they survive.

[Ben Rabidoux @BenRabidoux]

Canada has now posted three quarterly GDP declines in the past year. Now technically in recession

[Darcy Clarke @darcy]

@motdotla Ugh - any reason for using that acronym in particular? Seems like it's going to cause some confusion.

[Wes Bos @wesbos]

Everyone needs a metal tee. Varlock long sleeve goes HARD

[Darcy Clarke @darcy]

@DavidSherret I'll also double check on my end

[Darcy Clarke @darcy]

@DavidSherret Wow, that's a totally different problem. Could you share your package.json/config in an issue?

[Darcy Clarke @darcy]

@wesbos I forget, is "fron end developer" the french spelling?

[Darcy Clarke @darcy]

@wesbos Good ol' web archive

[Feross @feross]

Today is a big day for @SocketSecurity. We just raised a $60M Series C at a $1B valuation, led by @ThriveCapital with participation from @a16z, @AbstractVC, and @CapitalOne Ventures. Total funding is now $125M.

Four years ago, we started Socket because open source dependencies were flowing into production faster than anyone could vet them. AI has massively accelerated that. Code is being written, shipped, and deployed before any human reads it. Security has to operate at that same speed.

One data point from Thrive's diligence that I keep coming back to: they first discovered Socket because @cursor_ai, @OpenAI, and @AnthropicAI all independently told them it was the most important security tool they'd adopted for AI-driven development. Three of the most sophisticated AI companies converging on the same vendor unprompted.

Since our Series B, Socket has grown to more than 20,000 organizations, protecting over 1.5 million repositories and blocking more than 1,000 supply chain attacks every week. The team is now over 100 people.

Three out of five FAANG companies are Socket customers. So are the companies building the most ambitious AI products: @AnthropicAI, @cursor_ai, @xai, @figma, @vercel, @Replit, @scale_AI, @GustoHQ, @Mercadolibre, and @cribl_io, alongside Fortune 100s in financial services and global media.

What we've shipped since the last round:

• Socket Firewall blocks malicious packages at install time, before they reach a developer's laptop or CI pipeline. Free for everyone.

• Reachability analysis via our acquisition of Coana, eliminating 50-80% of irrelevant vulnerability alerts by focusing only on CVEs that are actually exploitable.

• Socket Certified Patches for remediating exploitable CVEs in seconds without waiting on upstream maintainers.

• Coverage extending to browser extensions, editor extensions, MCP servers, and AI tools via our acquisition of @secureannex.

When the Axios compromise hit, our detection systems flagged the malicious dependency within six minutes. Within 24 hours, more than 2,000 organizations onboarded to Socket to block it.

Where the funding goes: deeper investment in Firewall, massively expanding Certified Patches, moving protection closer to every point of install across the developer toolchain, and new product launches pushing Socket into a category we haven't entered before.

We're hiring across engineering, sales, customer success, and threat intel.

❤️ Thank you to our customers, investors, and the open-source community for your support. Together, we’re making software safer for everyone.

[Darcy Clarke @darcy]

Just reminded of this thread... and all of the reasons I quit GitHub...

[Darcy Clarke @darcy]

Great article: https://t.co/4GGw6AIq0Y

Notably, this is in part why I quit GitHub. npm package "provenance" was being shoved down our throats by package security "experts" without any meaningful reasons for how it made the ecosystem more secure (but here we are).

[Darcy Clarke @darcy]

https://t.co/GPHyZlAYU3

"This feature enables you to securely publish npm packages directly from CI/CD workflows using OpenID Connect"