Securing the open source supply chain with Feross Aboukhadijeh on the launch of Socket (Changelog Interviews #482)

Feross Aboukhadijeh discusses Socket, a tool that analyzes npm package content to detect supply chain attacks like malware and typosquatting. Socket scans every new npm package for 70 issues, including suspicious permission changes, network access, and install scripts. It provides a GitHub app that comments on pull requests with high-signal alerts, starting with typosquatting detection. Socket is free for open source and small teams; paid plans will target larger private repos. Future plans include support for other ecosystems like Python and Rust.