Blocking Software Supply Chain Attacks with Feross Aboukhadijeh

Modern software relies heavily on open source dependencies, often pulling in thousands of packages maintained by developers all over the world. This accelerates innovation but also creates serious supply chain risks as attackers increasingly compromise popular libraries to spread malware at scale. Faraz Abu Khadija is the founder and CEO of Socket, which is a security platform designed to protect software projects from open source supply chain attacks. In this episode, he joins Josh Goldberg to talk about his career in open source, open source supply chain attacks, practical security lessons, the expanding attack surface and software development, and more. This episode is hosted by Josh Goldberg, an independent full time open source developer. Josh works on projects in the TypeScript ecosystem, most notably TypeScript ESLint, a powerful static analysis toolset for JavaScript and TypeScript. He is also the author of The O'Reilly Learning TypeScript book, a Microsoft MVP for developer technologies and a cofounder of SquiggleConf, a conference for excellent web developer tooling. Find Josh on Blue Sky, fostidon,and.com as Joshua k Goldberg. Faraz, Abuka DJ, welcome to Software Engineering Daily. Thanks, Josh. Glad to be here. We're excited to have you. You have been in and around open source and general security practices for quite a while. Before we dive into you and socket, can you tell us how did you get into coding? Yeah. I got into coding when I was in high school. I wanted to build a website to collect my favorite Flash animations. So I was kind of born in the era of Newgrounds and e bombs world and albino black sheep and just all these kind of I don't know if folks remember these or if they're too young. I don't know the audience of this show, but, yeah, I always thought those things were fun and I wanted to kind of collect them all and put them onto one website. So I did a lot of downloading of those SWF files from other people's sites and then rehosting them on my own page. And I had to learn PHP to do that and MySQL, and so that was kinda my first foray. And then you went into Stanford for computer science after that? I mean, yes. I did go to Stanford to study CS. My high school didn't have a CS class, so I kind of was, you know, just self taught with PHP up until that point. But learning CS at Stanford was amazing. A lot of the other majors at Stanford, they don't necessarily emphasize teaching well, but that's one thing that the computer science department really stands out in. They have just like a ton of support, like other undergraduates actually are your TAs and like help teach you. And so I learned a ton. I remember my first class I took there, it was using C plus plus and I remember like my first reaction was, how does the computer know that these words are variables if they …