Sign In

Feross Aboukhadijeh

Founder & CEO of Socket, Open Source Developer

Feross Aboukhadijeh is the Founder and CEO of Socket, a company focused on enhancing security and privacy in software development, particularly concerning open-source software. He is based in the San Francisco Bay Area and has a strong background in technology and open-source contributions.

Background and Career

Feross graduated from Stanford University and has over a decade of experience in open-source software development. He is known for creating several widely used JavaScript packages and has previously worked at notable companies, including Intel, Facebook, and Quora. His early work includes developing PeerCDN, a pioneering peer-to-peer content delivery network.145

At Socket, Feross leads efforts to help developers and security teams manage and secure open-source dependencies, aiming to streamline the software supply chain while mitigating security risks. The platform is designed to assist organizations in auditing and managing their open-source software effectively.234

Contributions and Vision

Feross is passionate about improving the developer experience and addressing security challenges in software development. He emphasizes the importance of curiosity, persistence, and a love for technology as key traits for success in the tech industry. His vision for the future includes a more open technology landscape that prioritizes long-term impact over short-term gains.12

In addition to his role at Socket, Feross serves as a lecturer at Stanford, teaching courses on web security, further solidifying his commitment to education and the tech community.25

Highlights

Mar 27 · twitter

🚨 TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware

What happened: Versions 4.87.1 and 4.87.2 of the telnyx Python SDK on PyPI were compromised by TeamPCP with credential-stealing malware. PyPI has quarantined both versions. Users should pin to 4.87.0.

How it works: Three-stage attack chain. Malicious code injected into _client.py (the core HTTP client), so it fires at import telnyx – not via postinstall hooks, which are heavily monitored. Dual OS-specific paths: Windows gets a persistent binary dropped in the Startup folder disguised as msbuild.exe; Linux/macOS gets a one-shot fileless harvester that exfiltrates credentials and self-destructs.

Notable tradecraft:

  • Audio steganography for payload delivery – second-stage harvester hidden in WAV files downloaded from C2, extracted via base64 + XOR

  • Fileless execution on Linux – harvester runs via stdin pipe to a child Python process, never touches disk

  • Hybrid encryption on exfil – AES-256-CBC with RSA-4096 wrapped session keys using OAEP padding. Data is unrecoverable without the attacker’s private key

  • No new dependencies added – uses only stdlib modules and system openssl/curl

Operational details: The attacker shipped a bugfix release (4.87.2) solely to fix a case-sensitivity typo that broke the Windows path. This confirms sustained access to publishing credentials and an active testing pipeline. Neither malicious version has corresponding commits in the official GitHub repo.

C2: 83.142.209.203:8080, plain HTTP, telephony-themed filenames (ringtone.wav, hangup.wav).

Action items: Rotate all credentials from any environment that imported these versions. Block the C2 IP. Check Windows Startup folders. Purge from internal mirrors.

Mar 23 · twitter

Very important article to read based on @SocketSecurity research.

Feross Aboukhadijeh, Founder and CEO of Socket.dev, a startup ...
Feross Aboukhadijeh, Founder and CEO of Socket.dev, a startup ...
Dec 13 · Fortune
Socket - Fortune
Socket - Fortune
Nov 25 · 4imag.com
Meet the talent: Feross Aboukhadijeh, Founder and CEO of Socket
Meet the talent: Feross Aboukhadijeh, Founder and CEO of Socket
Aug 31 · Built In
Is a Decentralized Internet on the Horizon? - Built In

Related Questions

What inspired Feross Aboukhadijeh to start Socket?
How does Socket improve security and privacy on the web?
What are some recent supply chain attacks Feross has discussed?
How did Feross transition from being a developer to a CEO?
What makes Socket different from other security tools?
Feross Aboukhadijeh
Feross Aboukhadijeh, photo 1
Feross Aboukhadijeh, photo 2
Add to my network

Experience

Founder & CEO at Socket (June 2020 - Present)
Visiting Lecturer at Stanford University, Open Source Developer at Standard JS, WebTorrent, Brave Software, BitMidi, Software Engineer at Yahoo! Inc., Founder & CEO at PeerCDN

Education

Teaching Assistant for CS110: Principles of Computer Systems at Stanford University (2018 - 2020), Software Engineer Intern at Quora (2011), Software Engineer Intern at Facebook (2010), Web Developer & Videographer at Intel Corporation (2007 - 2008)

Location

San Francisco Bay Area