company
Software supply chain security company that reported the April SAP npm package compromise alongside Aikido.
No evidence-backed relationships are recorded.
Browser extensions update themselves silently unless new permissions are requested. Socket says it is now watching every version of every add-on in Mozilla's directory.
Reality
Socket says 40 of the 77 extensions it tracked are confirmed credential and wallet stealers, and nine of them were repurposed from sports-score shells under the same add-on IDs.
Reality
Security Hub Extended now pipes Chainguard and Socket findings into the same OCSF stream as endpoint and identity signals. Two curated partners is a category, not a market.
Reality
A dev.to walkthrough puts metadata and tarball inspection first, on the grounds that most npm malware fires during install and not at import. It needs nothing you have to buy.
Reality
V-etalon has no release date, no repository, and no published evaluation. Teams still treating NVD enrichment as authoritative should line up a second source now.
Reality
Graphify was a weekend project given away free. It is now callable by Claude Code, Cursor, Codex and Gemini CLI, which makes its maintenance a procurement question nobody is asking.
Reality