
Solutions Engineer @SocketSecurity | ex-Founding Engineer @momentohq 🐵 息子の大ファン🐯
Seattle
Joined September 2022
- Tweets2K
- Following547
- Followers396
- Likes5.3K
Pinned Tweet
I joined @SocketSecurity as Sales Engineer, Commercial! Excited to deep dive into software supply chain security and discussions with customers 🎉
SocketにSales Engineerとしてジョインしました!これからまた技術を通してお客様とお話できるのが楽しみです😊
AI turns new vulnerabilities into exploits within hours. Upgrading to patch is too slow.
In real codebases, @SocketSecurity can patch 25 to 50% of critical CVEs today without upgrading a single package. Every patch is human-reviewed. Critical patches are free.
socket.dev/features/patches
Some of the biggest openings in security have nothing to do with patching
How breaches began, per a 2026 report:
- 31% exploited a vulnerability
- 35% used phishing, stolen logins or impersonation scams
And nearly half now involve a vendor or partner, up 3x since 2024
Full piece from a16z's Asaf Ezra and Steph Zhang on six cybersecurity companies worth building: a16z.news/p/defense-in-depth…
Shai-Hulud turned one this September. Since that first npm worm: new waves, public source code, two alleged operators arrested in August, then tensorlake in October.
The worm doesn't need its authors anymore.
socket.dev/blog/happy-birthd…
Erika N Tharp (サープ恵里花) retweeted
Just spent the week in Chicago with this unbelievably driven team, and I couldn't be more excited for what's next. @socketsecurity is now in 4 out of 5 FAANG companies, 2 out of 3 hyperscalers, and nearly all the leading AI labs. It's amazing how much we've grown from the last time we were in Chicago two years ago. 🥹 And we're hiring across all teams! jobs.ashbyhq.com/socket?utm_…
Erika N Tharp (サープ恵里花) retweeted
🚨 A critical Rails Active Storage vulnerability (CVSS 9.8) can allow arbitrary file writes.
Need time to upgrade Rails? Our free Certified Patch applies a surgical fix to your current version. And you don't have to be a Socket customer to use it!
socket.dev/blog/rails-active…
Also, Replit’s sandboxes run @SocketSecurity on every package install. It blocks ~8,000 malicious packages a day.
replit.com/blog/package-fire…
Erika N Tharp (サープ恵里花) retweeted
💎 Socket researchers uncovered a Shai-Hulud descendant in a malicious Ruby gem, flagged 70 seconds after publication.
The worm steals credentials, poisons AI coding tools, and carries a wiper triggered by GitHub token revocation.
Full analysis: socket.dev/blog/shai-hulud-d…
Two years ago, we took a team photo in Chicago.
This week, we came back and took another one. All 175 of us.
It was the most exciting moment since I started Socket. I've never felt energy like this.
We're hiring in every department: socket.dev/jobs
SMB Sales Engineerだけではなく他のセグメントSEそして他チーム全体で採用強化中です!カジュアルに面談もできるので今日のある方はぜひDMください。
Two years ago, we took a team photo in Chicago.
This week, we came back and took another one. All 175 of us.
It was the most exciting moment since I started Socket. I've never felt energy like this.
We're hiring in every department: socket.dev/jobs
Erika N Tharp (サープ恵里花) retweeted
本日17時15分から、「サイバーセキュリティに関する関係閣僚会議」を開催しました。
昨今の深刻なサイバー攻撃の状況を踏まえ、早期に実施すべき施策を取りまとめた『緊急対策パッケージ』を策定しました。
『緊急対策パッケージ』は、
・AIも活用した基本的な対策の徹底
・情報収集・集約、捜査・分析体制の強化
・サイバー攻撃への対処の戦略的な実施
・被害者支援・被害拡大防止策の強化
の4つの柱からなります。
政府として、『緊急対策パッケージ』の早期かつ効果的な実行を通じ、サイバーレジリエンスの向上と国民の皆様の不安の払しょくにつなげていきます。
今朝の閣議で、直ちに必要となる約100億円の予備費を措置しましたが、『緊急対策パッケージ』全体の実施に必要となる財政措置の確保について、更に検討・調整を進めていきます。
また、制度面や体制面を含めた中長期的な課題についても更に検討を進め、官民一体となって、我が国全体の対処能力の強化に取り組みます。
具体的には、日本を標的としたサイバー攻撃を把握するための情報収集能力を更に強化するため、『サイバー対処能力強化法』の改正について、検討を進めます。
また、AI時代のサイバー攻撃のスピードに対応し、政府として機動的な対応がとれるよう、「国家サイバー統括室」への情報集約に要する時間を大幅に短縮することが必要です。
基幹インフラ事業者からの報告について、できれば数時間、少なくとも同日中には、攻撃を受けた旨の情報が伝わるようにすることを目指します。
現行の政府機関などに加えて、民間企業への不審な通信を「国家サイバー統括室」が把握・分析することが可能な仕組みについても、主要国の例も参考にしながら、検討します。
ITシステムや機器のサプライチェーンリスクも見過ごすことはできません。
政府システムの点検を進めるとともに、官民において、リスクを低減するために必要な制度について、「国家安全保障局」を中心に検討します。
今、この瞬間にも、不正アクセスや情報漏えいの事案が相次ぎ、国民生活や企業活動に大きな影響が生じています。
政府の総力を挙げて、我が国全体の対処能力を高めていきます。
Rare opportunity at intersection of PLG / security!
Replying to @SocketSecurity
@SocketSecurity is hiring a sales engineer for SMB customers. Most small companies have no security team, and their coding agents pull in dependencies faster than anyone can review them. You'd run demos and POCs.
If that's you, apply here or DM me.
jobs.ashbyhq.com/socket/de95…
SEチームは成長中です!
興味のある方はぜひDMください🚀
Replying to @SocketSecurity
@SocketSecurity is hiring a sales engineer for SMB customers. Most small companies have no security team, and their coding agents pull in dependencies faster than anyone can review them. You'd run demos and POCs.
If that's you, apply here or DM me.
jobs.ashbyhq.com/socket/de95…
SocketのリサーチがGizmodoで言及されました。
OSSパッケージはもちろんの事、悪意のあるブラウザ拡張機能も @SocketSecurity は防御します。
gizmodo.jp/article/2611-chro…
The biggest supply chain attacks of 2025 and 2026 hit legitimate packages during the release, usually on GitHub Actions.
Assume your build job will run something hostile. Keep publish credentials out of it.
New guide from @SocketSecurity:
socket.dev/blog/hardening-gi…
Socket now protects two of America's three largest automakers.
At one, Socket Firewall blocked every install attempt from August's keyv/cacheable npm worm. October's malicious LiteLLM release never even reached their developers.
Neither needed any cleanup.
Erika N Tharp (サープ恵里花) retweeted
🧊 Composer 2.11 adds dependency cooldowns, joining a growing number of package managers that delay newly published releases to reduce exposure to supply chain attacks.
It's opt-in, with overrides for urgent security fixes.
Details → socket.dev/blog/composer-dep…
Erika N Tharp (サープ恵里花) retweeted
A compromised release pipeline can ship malware through a legitimate package, even when its maintainers wrote no malicious code.
Our new guide covers how to harden GitHub Actions against outside attackers, with attack examples & practical configurations.
socket.dev/blog/hardening-gi…
Erika N Tharp (サープ恵里花) retweeted
There’s a lot of misinformation circulating about Claude Code 2.1.313 following inaccurate initial reports from other sources that have since been wholesale rewritten.
Those reports named Open VSX, npm and Microsoft’s marketplace. Our registry checks found no evidence of publication there. Cursor confirmed distribution through its own marketplace.
Here’s a breakdown of what we verified about distribution and potential exposure:
socket.dev/blog/claude-code-…
There’s a lot of misinformation circulating about Claude Code 2.1.313 following inaccurate initial reports from other sources that have since been wholesale rewritten.
Here’s a breakdown of what we verified about distribution and potential exposure:
socket.dev/blog/claude-code-…
















