Erika N Tharp (サープ恵里花)

Solutions Engineer @SocketSecurity | ex-Founding Engineer @momentohq 🐵 息子の大ファン🐯

[Erika N Tharp (サープ恵里花) @etharp5]

I joined @SocketSecurity as Sales Engineer, Commercial! Excited to deep dive into software supply chain security and discussions with customers 🎉

SocketにSales Engineerとしてジョインしました！これからまた技術を通してお客様とお話できるのが楽しみです😊

[Socket @SocketSecurity]

🚨 Mini Shai-Hulud/Miasma has now spread to PyPI.

Socket found 37 malicious artifacts across 19 PyPI packages.

The packages abuse #Python .pth startup behavior to launch a Bun-powered credential stealer targeting developer, cloud, and CI/CD secrets.

https://t.co/tYhmMqvjyw

[Socket @SocketSecurity]

RubyGems 4.0.13 adds a cooldown feature to Bundler for newly published gems.

The opt-in setting lets projects delay dependency resolution for new gem versions, reducing exposure during the short window when malicious releases often spread fastest.

https://t.co/c537BrueJj

[Erika N Tharp (サープ恵里花) @etharp5]

ぜひ @SocketSecurity 目線でお話しさせていただきたいなあ。

[Erika N Tharp (サープ恵里花) @etharp5]

気になる！最近日本のユーザーさんも増えており、日本内でのサプライチェーン攻撃に対する意識が高まっているのを感じてる。

[がっきー @keitah0322]

こちら6/9 火曜日に登壇させていただきます。まだまだ参加可能ですので、宜しくお願い致します。 https://t.co/DWEUYK2HfK

[Socket @SocketSecurity]

📦 @pnpmjs 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal.

As npm adds more release paths, registry metadata needs to make it clear how each package version was published.

https://t.co/hNerib86mu

[Socket @SocketSecurity]

💸 The Department of Commerce has released a sharply critical audit report on NIST’s management of the National Vulnerability Database.

Federal auditors found NIST:

• Had no strategic plan to clear NVD backlog
• Set an unrealistic backlog deadline
• Delayed use of CISA enrichment data
• Failed to prioritize KEVs quickly
• Relied on inefficient enrichment processes
• Eroded trust in the NVD through poor communication

The report also found that NIST and CISA ran overlapping enrichment programs without coordination, sometimes using the same contractor to perform the same work. Auditors identified at least 21,000 duplicated enrichment activities and ~$200K in wasted funds.

https://t.co/TuExuk5iWE

[Socket @SocketSecurity]

🚨 Active supply chain attack: A mini Shai-Hulud campaign hit npm packages under the @​redhat-cloud-services namespace.

The compromised packages execute install-time malware to harvest developer and CI/CD secrets, with encrypted exfiltration and GitHub-based fallback mechanisms.

[Socket @SocketSecurity]

Rust is moving toward a formal LLM contribution policy after months of heated internal debate, driven by a wave of low-effort "slop PRs" straining maintainers. The proposal bans LLM authorship but allows private use.

https://t.co/ec83y49xCs

[Socket @SocketSecurity]

Famous Chollima, the North Korean threat group known for fake job interview lures, appears to have used a PHP/Packagist package path in a targeted developer lure.

We found the loader in a compromised Laravel package, on a branch that could be installed through Composer. It was appended after a normal Tailwind config and used TRON, Aptos, and BNB Smart Chain RPC infrastructure to retrieve and run remote JavaScript.

Developers should be careful with “interview task” or “take-home project” requests that ask them to clone a repo, check out a specific branch, or install an exact dev dependency.

[Socket @SocketSecurity]

New research: A malicious NuGet package impersonating Sicoob’s official SDK exfiltrated client IDs, PFX passwords, and banking certificates through Sentry telemetry.

A fake SDK for stealing API secrets:

https://t.co/zn7Y1TYoWT

[Erika N Tharp (サープ恵里花) @etharp5]

@UG1N ゴミ出し監視おじさんとは…！笑

[Socket @SocketSecurity]

Open source maintainers were already overloaded. AI-driven vulnerability discovery is about to send a lot more findings their way.
@feross on @tbpn 👇 https://t.co/bhzqK84LmM #oss

[Erika N Tharp (サープ恵里花) @etharp5]

👀

[松本 美鈴🪽Oikaze Ventures @miaspired]

1年ぶりに、VC転職に興味がある女性向けのイベントを開催します！是非お気軽にご参加ください☺️
https://t.co/k6WBByXYfI

[Socket @SocketSecurity]

OSV has withdrawn 157 malware reports after automated detections incorrectly flagged npm and PyPI packages as malicious, pushing bad records for trusted projects into OSV-consuming security tools and CI/CD systems.

https://t.co/wKShstdUaD

[Erika N Tharp (サープ恵里花) @etharp5]

@hirokonishimura Baby carrot sticks (そのまま)とか味ついていないのり（そのまま）とかLalabarとかですかね〜

[Cointelegraph @Cointelegraph]

🚨 ALERT: TrapDoor malware is targeting crypto and AI developers via a supply chain attack, deploying 34 malicious packages to steal wallets, SSH keys, and API keys.

The malware also injects hidden instructions to hijack AI coding assistants including Claude and Cursor.

[Hackmanac @H4ckmanac]

🚨Cyber Alert ‼️

🇯🇵Japan - 𝗞𝗼𝗮 𝗚𝗹𝗮𝘀𝘀 𝗖𝗼., 𝗟𝘁𝗱.

The Gentlemen hacking group claims to have breached Koa Glass Co., Ltd.

Threat actor: The Gentlemen
Sector: Manufacturing
Data exposure (claimed): Not specified
Data type: Not specified
Observed: May 25, 2026
Status: Pending verification
ESIX©: 5.04

Full details and impact assessment on https://t.co/eB7qgxKFAa

[jonah @jonahseguin]

Can someone please explain to me why we are still waiting until AFTER a package is published and distributed to take action?

Why doesn’t npm scan packages with Socket or similar before allowing them to be distributed?

[Erika N Tharp (サープ恵里花) @etharp5]

@kameoncloud 一回も食べた事ないです！