Socket Security (socket.dev blog)

https://socket.dev/blog

Primary disclosure outlet for supply-chain security findings (TeamPCP/Mini Shai-Hulud, node-ipc, GemStuffer). Multiple in-window primaries in W21 run. Proposed by W1 sub-agent. | 2026-05-26: contributed TrapDoor + Packagist supply-chain primaries (S1, S3). | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://socket.dev/blog (listing) then webfetch the per-article socket.dev/blog/<slug> URL for body (full technical analysis renders). AVOID: Nothing to avoid; plain WebFetch works on listing and article. Listing mixes product-announcement posts (Socket MCP/Firewall) with the supply-chain research, filter to the package-compromise titles.. | 2026-07-05 admiralty audit: B, original supply-chain research from own scanning telemetry; reputable vendor lab. No status change (active). | 2026-10-02 (2026-10-02T0404Z-intel): the listing is a Next.js page; `url` or `extract` raw HTML carries a JSON blob with title, date and url per post (regex on the escaped keys).