Philipp Burckhardt @burckhap

⚡Securing Software Supply Chains at @SocketSecurity (https://t.co/rjmrp0fCL0) 🔭 Scientific computing for the web via @stdlibjs (https://t.co/nJc4oxoUlD) philipp-burckhardt.com Pittsburgh, PA Joined October 2010

Tweets

7K
Followers

2K
Following

2K
Likes

5K

Philipp Burckhardt @burckhap

2 months ago

More details on our blog, including recommended actions for defenders against yet another supply chain attack on the npm open-source ecosystem: socket.dev/blog/namastex-…

0 0 0 119 0

View Details

Philipp Burckhardt @burckhap

2 months ago

Today, Socket detected malicious Namastex.ai npm packages that appear to replicate TeamPCP-style Canister Worm patterns, including exfiltration and self-propagation.

1 3 5 2K 1

View Details

Philipp Burckhardt @burckhap

3 months ago

We identified 72 malicious Open VSX extensions linked to the GlassWorm campaign, including many cases where the malware is distributed transitively by being delilvered via covert extension packs. See below for link to our full coverage.

0 0 2 87 0

View Details

Alexandros Kapravelos @kapravel

8 months ago

We are starting a research internship program at @SocketSecurity We are particularly interested in PhD students who want to apply their research ideas in the broad space of software supply chain security and simultaneously gain industry experience and real-world impact.⬇️

1 8 3 2K 0

View Details

Philipp Burckhardt @burckhap

9 months ago

And the malicious Rust crates here socket.dev/blog/two-malic…

0 0 0 48 0

View Details

Philipp Burckhardt @burckhap

9 months ago

Stay vigilant and keep those dependencies scanned! Read more about the QR code attack here: socket.dev/blog/malicious…

1 0 0 67 0

View Details

Philipp Burckhardt @burckhap

9 months ago

While we haven't seen major supply chain attacks hitting any of the major open-source ecosystems, the Socket Threat Research Team uncovered some fascinating and creative attack techniques worth sharing:

1 0 0 88 1

View Details

Naugtur 💔🇺🇦 @naugtur

10 months ago

Hey, you! Want to protect your dev machine from npm malware without changing your workflow? Try a new tool that transparently isolates npm cli in a docker container. No need to remember to do anything! Early access: github.com/lavamoat/kipuka RT for reach 😉 and help me improve

3 14 19 2K 5

View Details

Philipp Burckhardt @burckhap

11 months ago

Direct link to post: blog.stdlib.io/reflection-on-…

0 0 0 69 1

View Details

Philipp Burckhardt @burckhap

11 months ago

On the @stdlibjs blog, we just published my take on @METR_Evals's surprising study: AI tools made experienced developers 19% slower (expectation: 40% faster!)🤯 I dive into the why, where AI coding tools actually help, and how I've shifted from handholding AI to async delegation.

a year ago

Over the last few months, I have been picking up Cursor again after finding it not substantially improving my productivity when I tried it last year. It, and the LLMs powering AI code completions, have gotten so much better that I now really enjoy its agent workflow.