Episode 36 of The Security Podcast of Silicon Valley aired on February 1, 2024, with Jon McLachlan hosting. The guest was Feross Aboukhadijeh. His LinkedIn lists him as founder and CEO of Socket since June 2020, and its headline reads “Created WebTorrent and StandardJS · Taught CS253 at Stanford” (Podbean, LinkedIn). Jon introduced Socket as “a cybersecurity platform that protects companies’ software supply chain against attacks.” The episode is called “Feross Aboukhadijeh, Founder and CEO of Socket.dev, a startup improving security and privacy on the web.” It has no video version.
The idea under all of it came up a quarter of the way in, when Jon asked how security came into Feross’s life.
“So the code is the actual source of truth”
Feross Aboukhadijeh, at 14:06
This page follows the conversation in order: a section for each part of it, nineteen figures, fifteen clips from the tape, a video, the full transcript, and five tools: a quiz, a scorecard for who reads the code your dependencies ship, a calculator for how much code you merge without reading it, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote those words.
Peer to peer in the browser
Jon opened with the résumé: internships at Intel, Facebook and Quora, a bachelor’s in computer science from Stanford and graduate study there, work as a teaching assistant and section leader, and then a company of his own right away. That company was PeerCDN, a content distribution network built on WebRTC, the browser technology that lets two machines talk directly. Wikipedia describes WebRTC as “a free and open-source project providing web browsers and mobile applications with real-time communication” (Wikipedia). Jon asked whether 2013 was about when WebRTC came out. Feross said it was, and that the browser was what drew him.
“And I felt like each one of these things was going to lead to, like, some type of important new company.”
Feross Aboukhadijeh, at 1:43
He had shipped one browser project before. In September 2010, as a Stanford student and a Facebook intern, he launched YouTube Instant, which let people search YouTube’s videos as they typed, and YouTube’s chief executive, Chad Hurley, offered him a job (Wikipedia).
Yahoo bought PeerCDN. Wikipedia’s list of Yahoo’s acquisitions dates the deal December 17, 2013 (Wikipedia), and Feross’s LinkedIn has him at Yahoo from December 2013 to February 2015, where he “Built fast, mobile-first HTML5 video player and deployed to 1B+ users.” Jon assumed Yahoo had put the peer-to-peer network in front of its users. Feross said the deal went another way.
“it was less them integrating the technology and more us just helping with our skills, to be honest.”
Feross Aboukhadijeh, at 2:12
That, he said, is what led him to leave and work on open source. Yahoo owned PeerCDN’s code, so he started over.
WebTorrent
Before WebRTC, Feross explained, the web was client and server. The browser could only ask, and the server answered with HTML.
“WebRTC gave us the ability to open a socket between my browser and your browser.”
Feross Aboukhadijeh, at 3:28
The idea he got into was BitTorrent over those connections: a swarm of peers, each sharing pieces of a file.
“It was a JavaScript implementation of BitTorrent that used WebRTC as the transport”
Feross Aboukhadijeh, at 3:51
The usual BitTorrent transports, TCP and UDP sockets, don’t work in the browser for security reasons, he said. Wikipedia calls WebTorrent a peer-to-peer “streaming torrent client written in JavaScript that enables BitTorrent functionality directly within web browsers,” and credits Feross as its creator (Wikipedia). His LinkedIn calls it “The first torrent client that works in the browser” and lists him as its author and maintainer from 2013 to 2022.
Ten years on, the project has a community of its own, and the protocol change reached the desktop clients.
“we changed the protocol and they adopted it.”
Feross Aboukhadijeh, at 4:28
When you torrent with one of the major clients, including uTorrent, he said, you share with people in browsers too. Jon called it a vision come to fruition: adoption changed how the underlying protocol works.
Torrents like PDFs
Next on Jon’s list: Feross was an open source software consultant for Brave, the browser. His LinkedIn dates the role from December 2016 to December 2021 and describes it in one line: “Integrated my WebTorrent open source project into Brave Browser.” Browsers open a PDF in place, without handing it to another program, Feross said.
“Their idea was, well, what if we did the same thing for torrents?”
Feross Aboukhadijeh, at 5:31
“So now all Brave users have WebTorrent built in to their browser out of the box.”
Feross Aboukhadijeh, at 5:51
TorrentFreak covered Brave’s torrent support on February 19, 2017. “Brave also supports torrent streaming,” it wrote, and it named Feross as the WebTorrent founder who helped build it (TorrentFreak).
Standard, as a joke
Then Standard JS. Feross built it because he was tired of giving style feedback on pull requests to WebTorrent. His own style was the odd one, he said:
“where you omit semicolons in JavaScript to make it look more like Python, and it actually works fine.”
Feross Aboukhadijeh, at 6:20
So he made a library to enforce it, a set of opinionated settings on top of ESLint, the static code analysis tool for JavaScript that Nicholas C. Zakas created in 2013 (Wikipedia). The name came from a script he wrote to see which relevant names were still free on npm. “Standard” was.
“I’ll call it JavaScript Standard Style, as if my style is the standard style that everybody should use, as a joke.”
Feross Aboukhadijeh, at 7:01
Two camps formed. His friends and fellow maintainers liked never having to argue style on a pull request again, and never having to configure anything.
“because the other linters require you to write, like, a 200-line config file to get it going, right?”
Feross Aboukhadijeh, at 7:30
The other camp objected to the name.
“You’re not the standards body to be able to say that it’s a standard.”
Feross Aboukhadijeh, at 7:57
That’s the critics’ line, as Feross told it. He answered with an LOL and admitted it was a bit of trolling.
He thinks it became the second most popular style in the JavaScript community, after Airbnb’s, at least when he last checked. His LinkedIn lists him as Standard’s author and maintainer from 2015 to 2022, at “7.5M downloads/month.” Jon’s rule on style is to keep whatever a project already uses. Feross added the teammate who slips a style change into an unrelated pull request, and Jon added the one whose editor restyles every file it opens.
“And you try to find, like, the actual semantic change, and it’s impossible.”
Jon McLachlan, at 9:07
CS 253
Jon brought up the course Feross started at Stanford, CS 253, Web Security. Stanford used to teach it when Feross was an undergraduate, and it was his favorite course by far. When he went back for his master’s, it was gone, and he was heartbroken. The final exam is why: a VM running a vulnerable e-commerce website, and the job was a pen test of it.
“And we had 24 hours.”
Feross Aboukhadijeh, at 10:07
“And so I think I found like 13 or 14 vulnerabilities in it.”
Feross Aboukhadijeh, at 10:12
Extra credit went to a bug the instructors hadn’t planted, and he found one of those too.
Then Stanford asked him to teach it. He had to rewrite all of it, because the course hadn’t run in about 10 years.
“It’s shocking how much better it is”
Feross Aboukhadijeh, at 10:47
And how much more complicated, he added. Cookies are his example: it used to be enough to explain how they work and how they’re attacked. Now there are the attributes, the settings and the new restrictions for ads and tracking. The course page for Fall 2021 lists him as instructor and calls the course “a comprehensive overview of web security,” from the same-origin policy, cookies and sessions to cross-site scripting, HTTPS, WebAuthn and DNS rebinding (Stanford). His LinkedIn dates the visiting lecturer role from September 2019 to 2023.
The child lock
Jon said he could hear the passion in Feross’s voice, and asked how security came into his life. Feross didn’t know the moment, but he had a story.
“I do remember this one story from my childhood that my parents liked to tell, which maybe shows the security mindset.”
Feross Aboukhadijeh, at 11:28
His parents got a new microwave, and he read the manual, as people did before YouTube. That’s how he found the child lock. When he was mad at his parents, he locked the microwave, and they had to cook on the stove or in the oven. Jon offered another way out:
“and maybe just a bowl of cereal.”
Jon McLachlan, at 12:25
They never learned the code, Feross said. They told him to undo it.
Written and unwritten rules
Feross took the microwave as a start, and maybe a stretch.
“I think security is like a mindset, right?”
Feross Aboukhadijeh, at 12:56
A lot of security people, he said, want to figure out how to break things. He sees a set of rules and sees the exploits, without wanting to use them.
“And you just see them because your mind works that way.”
Feross Aboukhadijeh, at 13:15
Jon called them Easter eggs.
“Things that are there, and they exist, and they were meant to be there”
Jon McLachlan, at 13:22
And they violate the spirit of how the system should work, he said.
Jon said The Matrix captured that spirit. It was one of Feross’s favorite movies growing up, and it gave him the frame.
“But yeah, it’s like there’s the written rules and there’s the unwritten rules.”
Feross Aboukhadijeh, at 13:42
In the case of computers, he said, the specs are the written rules,
“and then the actual code is the unwritten rules.”
Feross Aboukhadijeh, at 14:03
Everyone works from how a system is supposed to work. The exploit sits in the gap:
“you go look at the code, and you find a difference between the written and the unwritten, then that’s an exploit, or that’s a hack.”
Feross Aboukhadijeh, at 14:17
Jon agreed, 100%.
“That’s the difference between the expectation and the reality.”
Jon McLachlan, at 14:31
Finding those gaps, he said, is an art that rests on a science: you have to understand how computers work, and then you can still be surprised. The surprises can be security exploits. That was his way into Socket.
Most CVEs are noise
Feross started with what Socket is for.
“Socket is a tool that helps fight vulnerabilities and malware and supply chain attacks”
Feross Aboukhadijeh, at 15:14
The attacks come from your open source dependencies. They built Socket for visibility, defense in depth and proactive protection, he said, because they saw a gap in how people think about dependency security. Most people, and the security industry in general,
“is really obsessed with vulnerabilities”
Feross Aboukhadijeh, at 15:48
Fixing known vulnerabilities is a good baseline, he said. Then Jon raised how many there are, and Feross went further.
“Like, they’re not actually exploitable. The severities are overstated.”
Feross Aboukhadijeh, at 16:12
Vendors have an incentive to find as many as possible, he said, so they can point to thousands of vulnerabilities in their databases. A CVE is an entry in Common Vulnerabilities and Exposures, the reference list for publicly known security vulnerabilities (Wikipedia). His number is a guess, and he says so.
“probably 95% of CVEs are not worth even fixing.”
Feross Aboukhadijeh, at 16:33
The teams fixing them, he said, are often doing busy work. Jon put a cost on it.
“chasing these CVEs that probably don’t even have any paths from the outside world to be executed or exploited.”
Jon McLachlan, at 16:54
Five percent a week
The problem Socket solves came from another project first: Wormhole, an end-to-end encrypted file transfer app Feross built with a friend. They didn’t want to see anything their users did, so the security bar was high, and they met it.
“We had really strict code review, a strict content security policy.”
Feross Aboukhadijeh, at 17:27
They chose dependencies with care and ran the standard security tools. A content security policy is a standard that helps prevent cross-site scripting, clickjacking and other code injection attacks (Wikipedia). And still,
“we still had a dependency tree with thousands of dependencies in it.”
Feross Aboukhadijeh, at 17:38
They kept those dependencies current with Dependabot, which opens pull requests to update them. By Feross’s count, something like 5% of the app’s total code changed every week that way, and the app was 90% open source.
“You’re actually churning, like, a huge percentage of your app code every week.”
Feross Aboukhadijeh, at 18:19
And almost everybody, he said,
“doesn’t look at the code that they’re merging.”
Feross Aboukhadijeh, at 18:28
The nagging feeling was that they weren’t doing right by their users. One comparison made it sharp:
“Like, I was reviewing my teammates’ code more closely than I was reviewing the code written by these random people on the internet that were making my dependencies.”
Feross Aboukhadijeh, at 18:45
A juicy target
Jon spelled out the attack this invites. A big company uses a JavaScript library, which depends on three others, one of them lesser known.
“Could you just contribute something into that lesser-known library and introduce a vulnerability or a hiccup”
Jon McLachlan, at 19:51
“for a very juicy target, when you have a lot at stake?”
Jon McLachlan, at 20:04
Five hundred million downloads a month
Feross had felt that from the other side, as a maintainer.
“So I was a maintainer for, like, full-time maintainer for, like, I don’t know, five or six years, full-time just doing this.”
Feross Aboukhadijeh, at 20:16
His code ended up in a great many supply chains.
“So my packages alone are downloaded something like 500 million times per month on npm.”
Feross Aboukhadijeh, at 20:40
“And that’s 100 packages that I have access over.”
Feross Aboukhadijeh, at 20:46
Some maintainers have created 500 or 1,000 packages, he said, and he knows one person whose single account reaches further:
“17% of all downloads on npm are controlled by his one account.”
Feross Aboukhadijeh, at 20:58
He didn’t name him, and called him an amazing maintainer. Jon finished the thought: such a person would never do anything malicious, but
“you lose your laptop or something like that, you can also have a security breach”
Jon McLachlan, at 21:10
The event-stream backdoor
The second way in is the handover. New maintainers join projects all the time, Feross said.
“Maybe you get tired of maintaining something and you give it to somebody else to take over. That’s actually very normal and very healthy.”
Feross Aboukhadijeh, at 21:30
The case he remembers best is event-stream. Its maintainer, Dominic Tarr, had written 500-plus packages by Feross’s count, and no longer wanted to maintain this older one, which had millions of downloads a month. Someone offered to take it over, and he said yes, as maintainers normally do.
“They did good changes for about a month, and then they snuck in a backdoor.”
Feross Aboukhadijeh, at 22:22
It was aimed at one company. The attacker knew event-stream sat in a chain of dependencies that company used.
“It was designed to only execute in that particular environment that they wanted to target.”
Feross Aboukhadijeh, at 22:43
The code was heavily obfuscated and used the description of the top-level project as its key.
“use that as a decryption key to decrypt the malware.”
Feross Aboukhadijeh, at 22:58
Everywhere else, decryption failed and nothing happened. In the target’s build, it ran. The target was a crypto wallet app, and its users
“they had, like, all their crypto stolen.”
Feross Aboukhadijeh, at 23:26
On the tape, Feross says the problem first got on his radar in 2017. Wikipedia’s npm article dates the discovery to November 2018: a malicious package, flatmap-stream, had been added as a dependency of event-stream 3.3.6, and it “contained an encrypted payload that stole bitcoins from certain applications” (Wikipedia).
Raise the cost
Jon took the crypto wallet as the rule: money on the line makes you a target.
“You just need to raise the cost of the attack to make that payout not worth it from their perspective.”
Jon McLachlan, at 23:40
Attackers go after the lowest-hanging fruit, he said, and some run a business while others want street cred.
“But in some sense, their time is just as limited as ours”
Jon McLachlan, at 23:57
Every few minutes
People hadn’t seen the opening in open source until around then, Feross said. Socket has watched for it since.
“Socket monitors every new package that’s published to npm, PyPI, and the Go ecosystem.”
Feross Aboukhadijeh, at 24:26
Inside the company there’s a live threat feed of what they catch.
“And it’s like every few minutes there’s stuff we detect, and it’s outright malware.”
Feross Aboukhadijeh, at 24:43
Sometimes someone has compromised a package and added code to it. More often it’s a lookalike name.
“Or the most common attack is actually typosquatting, where they’ll register a name that’s similar to a popular package’s name and hope that people are going to typo the install.”
Feross Aboukhadijeh, at 24:51
Typosquatting began with web addresses: a form of cybersquatting that relies on people’s typos (Wikipedia). Feross has typoed installs himself, and raced to hit Control-C before they finished. Socket’s command line tool takes the race away. It intercepts npm install, and when the package you typed has 10 downloads and one a letter off has 10 million, it points you to the other one.
“And it’ll ask you if you’re sure before you proceed.”
Feross Aboukhadijeh, at 25:27
One minute with the diff
Jon pictured a static analyzer that flags patterns for a person to check, and asked whether people look. They do.
“Definitely have humans looking at everything that we flag.”
Feross Aboukhadijeh, at 25:57
At this scale, automation comes first, and Feross’s insight came from reading attacks. From 2017 on, each time one happened, he looked at the attack code.
“if somebody just had, like, looked at, for one minute, at this diff, they would see right there in front of their eyes”
Feross Aboukhadijeh, at 26:26
An obvious attack, he said. A giant blob of obfuscated code added to a file.
“Or, oh, look, they’re running eval on a giant base64-encoded string”
Feross Aboukhadijeh, at 26:41
Or a network request that sends off every environment variable the package can read, from a package that never needed the network before. Patch and minor versions are supposed to be small changes. When a patch release asks for new capabilities, that’s the tell.
“suddenly they’re claiming in this patch version that they need all this new permission, right?”
Feross Aboukhadijeh, at 27:18
Heuristics, then an LLM
Jon summed it up as Socket’s own heuristic for what risk looks like. Feross agreed, and said there’s more, with a caveat.
“and I hesitate to say AI, because everybody uses it as a buzzword in security.”
Feross Aboukhadijeh, at 27:45
For most of security, he said, AI has been a little bit of snake oil. The new large language models are his exception, and Socket started early.
“And we were playing around with GPT-3 back in, before ChatGPT had even come out”
Feross Aboukhadijeh, at 28:10
OpenAI released GPT-3 in 2020 (Wikipedia). Socket used it to explain package behavior. When a package makes a network call, the model is asked:
“what is the reason for this network call?”
Feross Aboukhadijeh, at 28:28
And what data it seems to send. Within a minute of a package being published, the static analysis heuristics run, then the model. If the model is confident enough that the package is malicious, Socket blocks it.
“So we have auto-blocks within minutes of publishing”
Feross Aboukhadijeh, at 29:04
Three months after this episode aired, Feross went deeper on models and defense on the a16z podcast, with a16z partner Joel de la Garza and Derrick Harris. Socket posted it to YouTube on May 6, 2024.
Two clicks
Jon guessed Socket was a command line tool. It has one, Feross said, but that isn’t how most people use it.
“most users use our GitHub app.”
Feross Aboukhadijeh, at 29:45
It’s listed in the GitHub Marketplace.
“It’s literally two clicks to install it.”
Feross Aboukhadijeh, at 29:56
There’s no change to CI and no new GitHub Action in each repository. Socket looks at the two moments new third-party code arrives: a pull request that adds a dependency, and one that updates a dependency. And it holds to one rule.
“And we do it where we never want to bother a developer with risk that they didn’t cause themselves in that pull request.”
Feross Aboukhadijeh, at 30:36
Risk already in the codebase is ignored. A typo package or malware blocks the pull request, and a suspicious change gets a warning. Jon liked that. Security done correctly, he said, fits into our daily lives and the processes we already have, and is almost invisible, except when there’s something to flag and an action to take.
As far left as we can
The command line tool still matters, Feross said, because intercepting installs protects the developer’s own laptop before any pull request exists.
“So we can shift left as far left as we can.”
Feross Aboukhadijeh, at 31:55
Further left is the browser. Socket’s Chrome extension works while a developer is still choosing a package. You land on a nice-looking npm package without knowing its transitive dependencies, its maintainer’s reputation, or whether one of them hides data exfiltration. Socket puts what it knows on that npm page,
“if there’s any red flags, right there at the top of the page.”
Feross Aboukhadijeh, at 32:59
The extension writes it plainly: this package uses the network, or this package steals your data. Jon compared it to a phone.
“It’s like those little warning signs that your iPhone will pop up, like, oh, this app wants your location.”
Jon McLachlan, at 33:08
Feross said that’s the analogy Socket uses itself.
“you should be able to know the permissions that your dependencies are using, just like you can on your iPhone.”
Feross Aboukhadijeh, at 33:23
Sold to executives
Jon liked how it fits what developers already do. Feross wished more of the industry thought that way, and had a guess why it doesn’t.
“I think it’s because security software is typically sold to executives.”
Feross Aboukhadijeh, at 33:46
The executives don’t use it. Jon took it from there: close the sale at the top with a couple of demos, and the buyer never touches the pain points under the hood. That sets the company up for a huge inconvenience. In a bottom-up go-to-market, he said, the users, the adopters and the buyers are the same people, and the tool goes from engineers on up the chain. He made it a point about leadership. Dictating solutions violates people’s autonomy, he said, and a leader should ask for them. Having to say you’re the boss leaves a bad taste. If you can’t convince someone smart that it’s right for the company, maybe it isn’t.
“And you have to have the humility, I think, as a leader to understand and appreciate that perspective.”
Jon McLachlan, at 35:41
No talk to sales
Feross said that’s what Socket is trying to do.
“So anyone can install Socket. You can try it out in two clicks”
Feross Aboukhadijeh, at 35:54
No call with sales is required, and Socket also works with CISOs, he said. The bottom-up part helps there: when a head of application security proposes Socket, developers who already use it raise their hands. No tool is perfect, he said, and then he made the case for looking past known vulnerabilities.
“Malware is way worse than the average vulnerability.”
Feross Aboukhadijeh, at 37:04
Most companies do nothing about it, he said, because checking a vulnerability database is easy, so everybody does that.
“The much harder problem is to say, what is this dependency going to do?”
Feross Aboukhadijeh, at 37:21
That, plus being in the developer’s workflow, is his recipe.
Fifteen people
Asked about a typical day, Feross said he spends a lot of it with customers: talking, demoing, helping, and bringing what he hears back to the team.
“And we actually do weekly planning cycles”
Feross Aboukhadijeh, at 38:08
There are monthly and quarterly goals too. Something a customer needs badly can be the next week’s work.
“We’re actually about 15 people right now.”
Feross Aboukhadijeh, at 38:37
“A lot of people think that we’re 50 or 100 people, just because of the rate that we ship stuff”
Feross Aboukhadijeh, at 38:44
The team is all senior people, he said. When TechCrunch covered the next round in October 2024, Socket had 32 employees and planned to reach 50 by the end of the year (TechCrunch).
The best day and the bad days
The best days, Feross said, are new large customers.
“we recently had a big customer switch over to Socket”
Feross Aboukhadijeh, at 39:20
It had used a tool that only does vulnerabilities. A careful company of that size saw a gap and chose Socket to fill it. That matters to a founder, he said,
“because so many startups don’t ever get to product market fit.”
Feross Aboukhadijeh, at 39:51
Jon congratulated him on the Series A.
“I saw on LinkedIn, a 20 million raise”
Jon McLachlan, at 40:06
Zane Lackey led it. Feross called him one of the founders of Signal Sciences, and said he had been an early angel in Socket.
“And then he joined Andreessen Horowitz and then led the investment in Socket.”
Feross Aboukhadijeh, at 40:27
Socket’s own announcement, on August 1, 2023, was “Announcing $20M Series A to Secure Open Source Software,” and it says Zane Lackey “was an early believer in Socket” (Socket). Zane’s post for a16z that day says, “We’re excited to lead Socket’s Series A” (a16z). Signal Sciences is the company Fastly announced it would buy for $775 million in August 2020 (Wikipedia).
The hard days, Feross said, have been ordinary ones. Nothing dramatic has gone wrong. The bad days are the ones that get by you.
“and then at the end of the day, you feel like, what did I really do today?”
Feross Aboukhadijeh, at 41:08
He’s ready again the next morning, he said. Jon added a sense of compassion for yourself, and one rule:
“there’s no such thing as failure unless you actually, like, give up”
Jon McLachlan, at 41:47
Wormhole first
Jon asked about the founding story, and whether Feross had co-founders. He didn’t.
“I would love to have had a co-founder, I have to say”
Feross Aboukhadijeh, at 42:21
Wormhole, with the same friend, was the company at the start. The plan was a suite like Google Workspace,
“So docs, spreadsheets, notes, emails, all that stuff, that was all end-to-end encrypted.”
Feross Aboukhadijeh, at 42:42
Jon saw the hard part.
“especially because, like, key lifecycle management is extremely complex.”
Jon McLachlan, at 42:51
In a browser it’s harder, Feross said: you fetch only the segments of data you need from the server and decrypt them as you go. So they started with file transfer, and set a bar.
“We wanted it to be better in user experience and better in security”
Feross Aboukhadijeh, at 43:44
Both mattered equally, he said.
The comparison was services like WeTransfer and Firefox Send. Firefox Send was Mozilla’s free encrypted file transfer service, from 2017 to 2020 (Wikipedia). Wormhole is still live at wormhole.app. Its home page today offers end-to-end encryption, a link that expires on its own and up to 10 GB a send, and its footer reads “Protected by Socket.” The first difference on the tape:
“Even before the files are finished uploading to the service, you get this link that you can just go and paste and send to whoever you’re trying to send it to.”
Feross Aboukhadijeh, at 44:22
Jon tried it during the recording.
“It’s like there is a wormhole.”
Jon McLachlan, at 44:46
The second difference is on the receiving end.
“So you could be 1% uploaded, and they’re like, I want to load this file over here.”
Feross Aboukhadijeh, at 45:13
Wormhole reprioritizes the upload to send that file first. And when both people are online, WebRTC connects the two browsers directly.
Ninety percent of the code
Jon called Socket a pivot to make Wormhole more secure. Feross agreed. They had done everything in their control, he said, except one thing:
“our pile of Node dependencies that were sitting there taunting us.”
Feross Aboukhadijeh, at 46:33
That pile was about 90% of their code, none of it audited, and they had only looked at the other 10%.
“how can we say our app is safe”
Feross Aboukhadijeh, at 46:41
Developers know this, he said, but don’t think deeply about it.
“Like, at the end of the day, it’s going to get all bundled together, and it’s going to run in one process.”
Feross Aboukhadijeh, at 46:59
“No, like, if you’re using it and it’s getting run in your app and it’s all running in the same process, like, it’s your problem.”
Feross Aboukhadijeh, at 47:13
They asked around, and nobody had a solution.
“They all said, why don’t you use this CVE scanner?”
Feross Aboukhadijeh, at 47:29
“Like, I know that we have zero CVEs.”
Feross Aboukhadijeh, at 47:37
His worry was malware, or a backdoor sending data. It doesn’t even have to be malicious, he said: some maintainers add analytics to learn who uses their package. Jon described opening a browser and watching JavaScript connect to random sites. Wormhole had a content security policy to stop data going anywhere, and they still wanted more layers. That’s defense in depth.
Thirty-nine of forty
So Feross went and asked.
“And then I decided to go out and actually formally interview, like, 40 application security leaders”
Feross Aboukhadijeh, at 48:45
He asked what they thought of the problem, what they did about it today, and whether they cared.
“Actually, 39 out of the 40 told me that they thought this was a top three priority”
Feross Aboukhadijeh, at 49:05
They had no good solution, and it was one of the things that kept them up at night. That gave him the confidence: his team had the problem, the leaders had it, and his team had an idea how to solve it.
Jon asked about the 40th. Feross wouldn’t name the company, an app people have heard of. Its answer was that they didn’t care about securing dependencies and let developers do what they wanted. He said it has been breached more than once since.
“Well, props for not throwing each other under the bus.”
Jon McLachlan, at 49:57
Budgets constrain people, Jon said. Feross said he doesn’t want to blame people. It was that company’s mindset he was answering.
The Matrix and Waking Life
Jon asked for a book or movie that changed how Feross saw the world.
“The most influential movie for me was when I was a kid and I watched The Matrix”
Feross Aboukhadijeh, at 50:47
Jon said The Matrix was his answer too. The Matrix is the 1999 film written and directed by the Wachowskis (Wikipedia). It got Feross into philosophy.
“How do you know that you’re in reality?”
Feross Aboukhadijeh, at 51:17
It holds up, he said. Both agreed, as a joke, that the sequels don’t exist. His second pick:
“another one that folks might enjoy is a movie called Waking Life.”
Feross Aboukhadijeh, at 52:03
Jon had never heard of it. Feross described interviews with professors and others about existence and experience, drawn over frame by frame.
“And because each picture was drawn individually, it doesn’t line up exactly between the frames.”
Feross Aboukhadijeh, at 52:49
Waking Life is Richard Linklater’s 2001 film, released October 19, 2001, and made with rotoscoping (Wikipedia), an animation technique of tracing over film footage frame by frame (Wikipedia).
Stay hungry, stay foolish
Jon closed by asking for words of wisdom.
“Stay hungry, stay foolish. There’s a lot of cool stuff out there in the world, and go forth and hack.”
Feross Aboukhadijeh, at 53:18
The first half is borrowed. Steve Jobs ended his June 2005 Stanford commencement speech with it, quoting the farewell message on the back cover of the last 1974 edition of the Whole Earth Catalog (Wikipedia).
What happened after the tape
A $40 million Series B. On October 22, 2024, Socket announced a $40 million round “led by Abstract Ventures, with participation from Elad Gil, Andreessen Horowitz (a16z)” and a group of angels (Socket). TechCrunch put the total raised at $65 million and wrote that Socket had “over 100 customers and protects more than 7,500 organizations” (TechCrunch).
Reachability. On April 23, 2025, Socket bought Coana to bring reachability analysis into the platform, aimed at “cutting false positives, accelerating triage” (Socket). Reachability asks whether your code can reach the vulnerable code at all, which is the question behind Feross’s 95% estimate in Most CVEs are noise.
A free firewall for installs. On September 30, 2025, Socket released Socket Firewall, “a free tool that blocks malicious packages at install time” (Socket). On the tape, the same job belonged to the command line tool that intercepts npm install.
A $60 million Series C. On May 20, 2026, Socket announced “$60 million Series C at a $1 billion valuation, led by Thrive Capital,” which brought its total funding to $125 million (Socket).
Code it never calls. On October 30, 2026, Feross wrote that Socket now protects five of the Magnificent Seven, and that the newest one bought it for precomputed reachability.
Many CVEs in an application's dependencies sit in code it never calls.
Feross Aboukhadijeh · October 30, 2026
Half the problem. On October 28, 2026, Feross wrote about a Trail of Bits test of 25 package managers against a compromised registry or mirror. Only Go and vcpkg verified the integrity of every package they downloaded.
Integrity is still only half the problem.
Feross Aboukhadijeh · October 28, 2026
Three ecosystems, then twenty. On the tape, Socket watched npm, PyPI and Go. A November 4, 2026 post announcing Socket Labs, a research group led by Alexandros Kapravelos, describes a live view across npm, PyPI, Maven, Go and Cargo, and an October 30 post counts 20 ecosystems (LinkedIn).
Twelve of the Fortune 100. In a November 5, 2026 post, Feross wrote that Socket’s protection runs at twelve of the Fortune 100, and that it “also protects the world’s largest company and twenty-two of the Fortune 500” (LinkedIn). On the tape, the team was about 15 people.
Teaching and investing. His LinkedIn dates the Stanford lecturer role from September 2019 to 2023, and lists him as an angel investor and a16z scout since 2022 (LinkedIn).
More on this show. Jack Cable named Feross among the angels in Corridor’s first round on episode 84. Jon told Georgianna Shea about this conversation, which he had just recorded, on episode 48. Neatsun Ziv of OX Security sampled a company’s five million issues and found most of them weren’t relevant, on episode 91. Simon Wijckmans of cside walked through the polyfill.io supply chain attack on episode 54, and Rejah Rehim explained what shifting left means on episode 82.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What does Feross call the specs and the code?
a. "and then the actual code is the unwritten rules." The specs are the written rules. Transcript, 14:03.
-
How long was the CS 253 final exam Feross took as an undergraduate?
b. "And we had 24 hours." The exam was a pen test of a vulnerable e-commerce site. Transcript, 10:07.
-
What share of CVEs does Feross estimate aren't worth fixing?
c. "probably 95% of CVEs are not worth even fixing." He calls it a guess. Transcript, 16:33.
-
How much of Wormhole's code changed each week through dependency updates, by Feross's count?
a. "You're actually churning, like, a huge percentage of your app code every week." His count is something like 5% of the app's total code. Transcript, 18:19.
-
How did the event-stream backdoor stay hidden from everyone but its target?
b. "use that as a decryption key to decrypt the malware." The key came from the top-level project's description. Transcript, 22:58.
-
Which analogy does Socket use for what a dependency is allowed to do?
b. "you should be able to know the permissions that your dependencies are using, just like you can on your iPhone." Transcript, 33:23.
-
Of the 40 application security leaders Feross interviewed, how many called the problem a top-three priority?
c. "Actually, 39 out of the 40 told me that they thought this was a top three priority" Transcript, 49:05.
Who reads your dependencies?
Eight questions on whether anyone checks what the code you pull in does, from the episode. Each tip quotes the tape or paraphrases it, and links its section.
Scorecard · eight questions
Who reads your dependencies?
Answer for your main product and everything it installs. If two answers fit, pick the lower one.
-
When a pull request adds or updates a dependency, does anyone check what the new code does?
- No, we merge the update
- Someone reads the changelog
- A tool or a person checks the code's behavior
Almost everybody, Feross says, "doesn't look at the code that they're merging." See Five percent a week.
-
What happens when someone installs a lookalike of a popular package?
- Nothing stops it
- We would find it later
- The install is checked before it runs
Typosquatting is the most common attack Socket sees, Feross says. See Every few minutes.
-
Would you notice a patch release that suddenly wants the network or your environment variables?
- No
- Only if a scanner has a signature for it
- Yes, new capabilities in a release get flagged
"suddenly they're claiming in this patch version that they need all this new permission, right?" See One minute with the diff.
-
How do you decide which CVEs in your dependencies to fix?
- We try to fix them all
- By severity score
- By whether our code can reach them
Jon's cost: "chasing these CVEs that probably don't even have any paths from the outside world to be executed or exploited." See Most CVEs are noise.
-
What do your pull request checks report?
- We have none for dependencies
- Everything, on every pull request
- Only the risk this pull request adds
Socket never wants to bother a developer with risk they didn't cause in that pull request. See Two clicks.
-
Do you know who can publish the code you run?
- No
- For our direct dependencies
- For the whole tree, and we watch for new maintainers
"17% of all downloads on npm are controlled by his one account." See Five hundred million downloads a month.
-
Does your web app limit where its pages can send data?
- No content security policy
- A loose one
- A strict policy, with another layer behind it
Wormhole had "a strict content security policy" and still wanted defense in depth. See Ninety percent of the code.
-
What do developers check before they choose a new package?
- Nothing
- Downloads and stars
- Its dependencies, its maintainers and what it does
Socket's browser extension puts the red flags at the top of the npm page. See As far left as we can.
Code you don't read runs in your process. Start with installs: block lookalike names, and have someone or something read the next dependency update before it merges.
You catch some of it. Next, flag new capabilities in patch releases, triage CVEs by whether your code can reach them, and limit pull request checks to the risk each change adds.
You know what your dependencies do and who publishes them. Keep the policy strict, and recheck it each time a maintainer changes.
How much code you merge unread
Feross’s number for Wormhole was something like 5% of the app’s total code changing every week through dependency updates. This calculator shows what that means for your app, and how long it would take to read.
Calculator
How much code you merge unread
Three numbers: your app's lines of code with its dependencies, the percent that changes each week, and how many lines a reviewer reads in an hour.
With 1,000,000 lines and 5.0% changing each week, 50,000 lines change every week. At 200 lines an hour, reading them takes 250 hours a week, and 2,600,000 lines change in a year.
The 5% is Feross's number for Wormhole, from the tape. The 1,000,000 lines and the 200 lines an hour are placeholders: put in your own numbers.
From PeerCDN to Socket
Feross’s path, Socket’s growth, the supply chain attacks on this page, and the episodes on this site that pick up the thread. Filter by topic.
Timeline
From PeerCDN to Socket
- YouTube Instant
Feross launches search as you type for YouTube (Wikipedia, on this page).
- PeerCDN
Founder and CEO of a CDN powered by WebRTC (LinkedIn).
- ESLint
Nicholas C. Zakas releases the linter Standard later builds on (Wikipedia, on this page).
- WebTorrent
The first release (Wikipedia, on this page).
- Yahoo buys PeerCDN
Feross works at Yahoo until February 2015 (Wikipedia, LinkedIn).
- Standard JS
Feross starts the style guide, linter and formatter (LinkedIn, on this page).
- Torrents in Brave
TorrentFreak reports Brave's torrent streaming, built with Feross's help (TorrentFreak, on this page).
- event-stream
A malicious dependency, flatmap-stream, is found in event-stream 3.3.6 (Wikipedia, on this page).
- CS 253
Feross starts teaching Web Security at Stanford (LinkedIn, on this page).
- Socket
Feross founds the company (LinkedIn, on this page).
- Signal Sciences
Fastly announces it will buy the company Zane Lackey co-founded, for $775 million (Wikipedia).
- Series A
$20 million, led by Zane Lackey at Andreessen Horowitz (Socket, a16z, on this page).
- Episode 36
Feross on the show (Podbean, transcript).
- AI + a16z
Feross on models and supply chain attacks (YouTube, on this page).
- Episode 48
Jon tells Georgianna Shea about this conversation (episode page).
- Episode 54
Simon Wijckmans on the polyfill.io attack (episode page).
- Series B
$40 million, led by Abstract Ventures (Socket).
- Coana
Socket buys a reachability analysis company (Socket).
- Socket Firewall
A free tool that blocks malicious packages at install time (Socket).
- Episode 84
Jack Cable names Feross among Corridor's angels (episode page).
- Episode 91
Neatsun Ziv on five million issues (episode page).
- Series C
$60 million at a $1 billion valuation, led by Thrive Capital (Socket).
- Socket Labs
A research group for supply chain and AI security (LinkedIn).
What to do this week
Five things, in the order of the episode.
- Read one dependency update. Open the next pull request that bumps a dependency and look at what changed, then take the scorecard with your team.
- Triage CVEs by reach. Ask which ones your code can reach before anyone spends a week on them, as in Most CVEs are noise.
- Check installs before they run. Lookalike names are the most common attack Feross sees, as in Every few minutes.
- Flag new capabilities in a release. A patch that suddenly wants the network or your environment variables deserves a look, as in One minute with the diff.
- Get help with the gates. Our Secure AI SDLC & Engineering work builds review gates and protected branches for the code that lands in your repos, and our AI-Accelerated Vulnerability Remediation Program triages the backlog by reachability. If you want to talk it through, book 15 minutes with us.