Here’s some Rust code: // define a function fn foo (x : i32 , y : i32 ) -> i32 { // body elided } // call it let z = foo ( 5 , 6 ); In programming language jargon, we call x and y parameters and 5 and 6 arguments . Rust does not have many fancy features related to parameters and…

Yes, the underlying model must have three states, but one is always irrelevant to the actual user goal. Users do not seek out solutions to problems they don’t currently have. A lot of the hate towards...

The next-generation social coding platform.

Socket uncovered 17 malicious npm and PyPI packages typosquatting Paysafe, Skrill, and Neteller SDKs to steal developer secrets.

HTTP QUERY sends safe, idempotent queries with a request body. Overcome URI length limits for complex searches, GraphQL, and structured filter operations.

npm v12 is generally available, turning install scripts off by default and beginning the deprecation of 2FA-bypass publishing tokens.

npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…

pnpm 11.10 hardens registry auth to block token redirection, tightens pack-app and deploy, and makes the Rust port (v12) installable.

What is the issue with the HTML Standard? https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-single-module-script:~:text=response%27s%20status%20is%20not%20an%20ok%20status%2C,-then%20s...

npmx 0.16 is out! This period was especially full of good news. And it’s particularly great that, amid the constant search for vulnerabilities and risks, we’ve started celebrating more and taking joy ...

A tool for analyzing Node.js/v8 (de)optimizations. - e18e/deopt

Today we are releasing Babel 8. It's been 8 years since we released Babel 7. And that's not without reason.

pnpr is a pnpm-compatible npm registry server, written in Rust. It speaks the

A thought experiment about what a package registry would look like if built on atproto.

Hi everyone — sharing this so maintainers, application developers, and CI operators have time to prepare for behavioral changes landing in npm v12 (estimated July 2026). Everything below is already...

Create and manage Linear issues directly from Socket alerts, with manual creation and automated ticketing rules.

Browse @npmx.dev's app.bsky.graph.verification collection on Taproot

Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.

Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.

npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Documentation for the npm registry, website, and command-line interface

Socket is scaling to defend open source against supply chain attacks as AI accelerates software development.

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.