<story><title>Show HN: Socket – Secure your JavaScript supply chain</title><url>https://socket.dev</url><text>Excited to share the project I&amp;#x27;ve been working on for the past 7 months!&lt;p&gt;We&amp;#x27;ve seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I&amp;#x27;ve watched it only get worse over the years. I finally decided to try to solve this problem.&lt;p&gt;Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the package code to characterize the package&amp;#x27;s behavior. This way, Socket can detect when packages use security-relevant platform capabilities, such as the network, filesystem, or shell.&lt;p&gt;You can search for any npm package and see issues that&amp;#x27;ve we&amp;#x27;ve flagged for each package. We look for 70 issues (full list here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;issue&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;issue&lt;/a&gt;) and we put those into a Package Health score. See these examples:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;left-pad&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;left-pad&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;lodash&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;lodash&lt;/a&gt;&lt;p&gt;Socket looks for indicators present in all of the recent npm supply chain attacks. We&amp;#x27;re proactively auditing every package on npm to flag these issues.&lt;p&gt;Separately, we have a GitHub app that you can install. It detects typosquat attacks and leaves a comment on your pull request to let you know you might have installed the wrong package. We&amp;#x27;re currently working to enable it to leave comments for more of the package issues that we can detect, but we want to get the UX really good on that first, so we&amp;#x27;ve released it and labeled it &amp;quot;beta&amp;quot;.&lt;p&gt;Happy to answer questions.</text></story><parent_chain></parent_chain><comment><author>armchairhacker</author><text>I would honestly completely ditch the Socket &amp;quot;ratings&amp;quot;. React = 70 - what the hell does that mean? &amp;quot;quality = 82, license = 70&amp;quot; where did you get those numbers? They are basically made-up.&lt;p&gt;There are certain ways you can objectively determine the security of a package:&lt;p&gt;- If it or one of its dependencies has been compromised&lt;p&gt;- If it and its dependencies are made by a trusted org (e.g. I would trust something from Microsoft more than something from a random developer)&lt;p&gt;- If it and its dependencies have been audited and verified (this could even be a quality audit, or something like the Elm ecosystem)&lt;p&gt;- If it and its dependencies are made by you, you can be pretty confident that nobody has tampered with them&lt;p&gt;Similarly there are ways to determine the quality (e.g. code coverage, usage, whether it has tests). And of course you can see the license.&lt;p&gt;But state these things directly, don&amp;#x27;t try to summarize them with numbers. Because ultimately those numbers are almost meaningless and make your tool look fake.</text></comment>
<story><title>Show HN: Socket – Secure your JavaScript supply chain</title><url>https://socket.dev</url><text>Excited to share the project I&amp;#x27;ve been working on for the past 7 months!&lt;p&gt;We&amp;#x27;ve seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I&amp;#x27;ve watched it only get worse over the years. I finally decided to try to solve this problem.&lt;p&gt;Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the package code to characterize the package&amp;#x27;s behavior. This way, Socket can detect when packages use security-relevant platform capabilities, such as the network, filesystem, or shell.&lt;p&gt;You can search for any npm package and see issues that&amp;#x27;ve we&amp;#x27;ve flagged for each package. We look for 70 issues (full list here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;issue&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;issue&lt;/a&gt;) and we put those into a Package Health score. See these examples:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;left-pad&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;left-pad&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;lodash&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;lodash&lt;/a&gt;&lt;p&gt;Socket looks for indicators present in all of the recent npm supply chain attacks. We&amp;#x27;re proactively auditing every package on npm to flag these issues.&lt;p&gt;Separately, we have a GitHub app that you can install. It detects typosquat attacks and leaves a comment on your pull request to let you know you might have installed the wrong package. We&amp;#x27;re currently working to enable it to leave comments for more of the package issues that we can detect, but we want to get the UX really good on that first, so we&amp;#x27;ve released it and labeled it &amp;quot;beta&amp;quot;.&lt;p&gt;Happy to answer questions.</text></story><parent_chain></parent_chain><comment><author>syntheticcdo</author><text>Why does Socket flag npm packages with &amp;quot;MIT&amp;quot; in the license field as non-FSF approved, such as in lodash [1]. It appears the FSF seems to prefer to call the MIT license &amp;quot;Expat&amp;quot; -- but Expat&amp;#x27;s SPDX identifier is literally &amp;quot;MIT&amp;quot;.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;lodash&amp;#x2F;files&amp;#x2F;4.17.21&amp;#x2F;package.json#L9&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;socket.dev&amp;#x2F;npm&amp;#x2F;package&amp;#x2F;lodash&amp;#x2F;files&amp;#x2F;4.17.21&amp;#x2F;package....&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;directory.fsf.org&amp;#x2F;wiki&amp;#x2F;License:Expat&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;directory.fsf.org&amp;#x2F;wiki&amp;#x2F;License:Expat&lt;/a&gt;</text></comment>