Solutions Engineer @SocketSecurity | ex-Founding Engineer @momentohq 🐵 息子の大ファン🐯
Seattle
Joined September 2022
- Tweets1.9K
- Following544
- Followers395
- Likes5.3K
Pinned Tweet
I joined @SocketSecurity as Sales Engineer, Commercial! Excited to deep dive into software supply chain security and discussions with customers 🎉
SocketにSales Engineerとしてジョインしました！これからまた技術を通してお客様とお話できるのが楽しみです😊
Erika N Tharp (サープ恵里花) retweeted
There’s a lot of misinformation circulating about Claude Code 2.1.313 following inaccurate initial reports from other sources that have since been wholesale rewritten.
Those reports named Open VSX, npm and Microsoft’s marketplace. Our registry checks found no evidence of publication there. Cursor confirmed distribution through its own marketplace.
Here’s a breakdown of what we verified about distribution and potential exposure:
socket.dev/blog/claude-code-…
Erika N Tharp (サープ恵里花) retweeted
There’s a lot of misinformation circulating about Claude Code 2.1.313 following inaccurate initial reports from other sources that have since been wholesale rewritten.
Here’s a breakdown of what we verified about distribution and potential exposure:
socket.dev/blog/claude-code-…
Erika N Tharp (サープ恵里花) retweeted
Socket now protects five of the Magnificent Seven.
The newest bought Socket for our patented precomputed reachability. We analyze every open source package as it's published, so reachability works from an SBOM alone. In the POC it cut their CVEs needing triage in half.
Erika N Tharp (サープ恵里花) retweeted
An OpenCode user reported a free AI loophole and got a torrent of abuse from people who blamed them for cutting off access. In a bizarre twist, the reporter went from proposing a fix to boasting about running 130 agents through the loophole.
Full story → socket.dev/blog/opencode-fre…
Erika N Tharp (サープ恵里花) retweeted
ALT 13.4M That's how many installs we discovered have had their searches hijacked by 319 hidden browser extensions across a decade of time. These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing.
Erika N Tharp (サープ恵里花) retweeted
Cursor has removed a malicious Claude Code 2.1.313 extension from its marketplace. Despite early reports naming Open VSX and npm, we found no record of that version being published on either registry.
socket.dev/blog/claude-code-…
Erika N Tharp (サープ恵里花) retweeted
Last week's malicious LiteLLM release never reached developers at two @SocketSecurity customers. At a leading AI lab, Firewall blocked it on arrival, then every retry. At a top-3 US automaker, pip never offered it.
No cleanup at either.
socket.dev/blog/litellm-comp…
Erika N Tharp (サープ恵里花) retweeted
A browser extension with no permissions and no code can still see every search you make.
@SocketSecurity found 319 extensions with 13.4M users that just swap the default search engine for the operator's proxy. The proxy decides where each query lands.
socket.dev/blog/searchjacked
Erika N Tharp (サープ恵里花) retweeted
Node.js shipped fixes for 10 vulnerabilities on Oct 21. Anthropic said it found 29,000+ candidate bugs over six months and manually reviewed about 6,000.
Finding bugs is getting cheap. The bottleneck is now remediation. Fund the people who fix them.
socket.dev/blog/openjs-nodej…
Erika N Tharp (サープ恵里花) retweeted
Socket now protects the world's largest company. That makes two of the Fortune 5 and ten of the Fortune 100.
Developers, build servers, and AI agents install packages faster than anyone can review them. Socket checks what each one does before it's installed.
Erika N Tharp (サープ恵里花) retweeted
Socket uncovered malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget to steal recovery phrases and private keys. The fake Phantom wallet also bundled the operator’s backend for automatically draining funds.
socket.dev/blog/firefox-wall…
Erika N Tharp (サープ恵里花) retweeted
Node patched eMudhra and Brotli last week, but updating Node only covered part of the problem. Other applications carried their own copies of Brotli or still trusted the compromised certificates, leaving teams with more software to find and fix.
socket.dev/blog/emudhra-brot…
Erika N Tharp (サープ恵里花) retweeted
【調査レポート（日本語訳）公開のお知らせ】
一昨日投稿しました第三者機関（@nebusecurity）によるセキュリティインシデント調査報告書の日本語訳を、弊社Webサイトにて公開いたしました。
調査結果の詳細については、以下よりご確認いただけます。
pingcap.co.jp/trust-hub/secu…
Erika N Tharp (サープ恵里花) retweeted
Happy to have helped LiteLLM with this incident behind the scenes
We have completed our investigation into the attack chain behind the v1.107.0 release. Read it here: docs.litellm.ai/blog/securit…
Erika N Tharp (サープ恵里花) retweeted
GMO 不正アクセス問題で政府に「能動的サイバー防御」を要請
news.web.nhk/newsweb/na/nd-2…
#nhk_video
Erika N Tharp (サープ恵里花) retweeted
GMOの件、めちゃくちゃヤバいです。
正直日本史上最大級のサイバー事件になっています。
このツールを使っていたユーザーのPCの情報を乗っ取られ、暗号化されるだけでなく、
・ブラウザの閲覧履歴
・PC内の企業機密情報を、
【PC内にある取引先に送信】までされる可能性がある
被害者となった人はまず
「お名前.com デスクトップクラウド」ご利用のお客様へ改めてのお願い（第5報） | GMOインターネットグループ株式会社 group.gmo/info/alert/2026102…
Erika N Tharp (サープ恵里花) retweeted
Attackers were stealing secrets from LiteLLM's GitHub org 11 days before the malicious litellm 1.107.0 release.
The trick: push a workflow to a throwaway branch, let on: [push] run it with real secrets, delete the branch. 20 secrets taken, including a GitHub App private key.
socket.dev/blog/litellm-atta…
Erika N Tharp (サープ恵里花) retweeted
🚨 New investigation: Socket found malicious LiteLLM workflows running 11 days before the attack, targeting 20 secrets including GitHub, cloud, and AI credentials.
After our disclosure, LiteLLM linked a stolen token to approval of the malicious release.
socket.dev/blog/litellm-atta…
Erika N Tharp (サープ恵里花) retweeted
🚨Cyber Alert ‼️
🇯🇵Japan - 𝗣𝗶𝘇𝘇𝗮 𝗛𝘂𝘁 𝗝𝗮𝗽𝗮𝗻 𝗟𝘁𝗱.
Pizza Hut Japan Ltd. disclosed a data breach affecting its online ordering service after unidentified attackers gained unauthorised access to a payment API on October 19, 2026, retrieving customer information from a connected database.
According to the company, the compromised data includes customer IDs, email addresses, phone numbers, deleted account records, session login tokens, and transaction records.
Threat actor: Not specified
Sector: Hospitality
Data exposure (claimed): Not specified
Data type: Customer records, contact details, session login tokens, transaction records
Observed: Oct 23, 2026
Status: Pending verification
ESIX©: 4.35
Full details and impact assessment on HackRisk.io
