Engineering Manager

Socket buys Secure Annex to expand supply-chain visibility. Combined Platform Spans Dependencies, Extensions, Developer Tools Michael Novinson (MichaelNovinson) - April 30, 2026 Socket purchased an extension security startup led by a longtime Tines manager to give organizations visibility and control across the entire development life cycle. The proposed deal will bring together San Francisco-based Socket's focus on application dependencies such as open-source libraries with Kansas City-area Secure Annex's concentration on browser and IDE extensions, said Socket founder and CEO Feross Aboukhadijeh. He said modern development workflows involve a continuous chain that includes code editors, artificial intelligence assistants, third-party packages and extensions. "When we started, we were very focused on application dependencies, your JavaScript, your Python, your Java and Secure Annex started from the extension perspective," Aboukhadijeh told ISMG. "John and his company were focused from the beginning on extensions, and I think bringing the two together gives us really good coverage across all the ecosystems that matter." Secure Annex, founded in November 2024 and counts Tuckner as its sole employee. He spent more than four years at Tines, where Tuckner created a team focused on security automation research. Tuckner led customer success engineering at Cyderes, was a principal solutions engineer at Optiv, an information security architect at Apria Healthcare and a security infrastructure engineer at H&R Block (see: Socket Acquires Startup Coana to Boost Code Risk Precision). How AI has changed supply-chain defense. Software supply-chain attacks are no longer confined to traditional package repositories such as npm, and are instead targeting a wide range of distribution channels, including Docker images, browser extensions and developer tools. This diversification of attack vectors significantly expands the risk landscape, and Socket aims to address this by extending coverage across multiple ecosystems, he said. "There's just so much more to this as AI is evolving," Tuckner said. "There's code extensions, there's AI skills, there's MCP servers that have just hit the scene over the past year. This problem was much bigger, but these teams are still all struggling with it. And in order for me to truly do what I set out to do, it might take a lot more funding or a lot more resources." AI enables automated analysis at a scale that was previously impossible, helping identify malicious packages and suspicious behavior more effectively, Aboukhadijeh said. AI is also changing who participates in software development, with citizen developers building and deploying code often without a deep understanding of security best practices, Tuckner said. "Traditionally, developers have almost unfettered access into the most sensitive information in companies," Tuckner said. "And now, given AI is here, it's turned everybody into a citizen developer and they're now also getting access into these very sensitive credentials." For some time, development workflows were moving entirely to the cloud, but the rise of AI-powered tools running locally has reversed that trend, with developers relying heavily on applications installed on their laptops, including code editors, extensions and AI assistants. Secure Annex plays a key role here by focusing on controlling what gets installed and executed at the endpoint level, Tuckner said. "There was a browser extension that was compromising crypto wallets that started with an npm attack," Tuckner said. "As I'm responding to a browser extension compromise, I'm finding that I need information about the npm space, which for us is paramount. Being able to tie that all together now in one platform will really help a lot of teams." Why Browsers and IDE extensions pose a security risk. Browsers and IDE extensions often appear benign and are trusted by default, yet they can have deep access to sensitive data and workflows. Marketplaces for extensions have historically been slow to detect and respond to malicious activity. The combined platform aims to address this by introducing pre-installation controls, helping organizations block or vet extensions before they're deployed. "I started Secure Annex about a year and a half ago on a very niche problem of browser extensions, and so I was very targeted," Tuckner said. "I see this as a problem in security that the larger players aren't addressing, and I think I can go out and solve this problem." MCP servers blur the line between developer tools and consumer applications, with both technical and non-technical users contributing to the software supply chain, Tuckner said. This convergence increases complexity and introduces new types of risk, including attacks that leverage natural language interactions with AI systems, Tuckner said. "MCP really is symbolic of this merging of both the developer and the consumer, and now that everybody is just contributing to the supply-chain software problem and the ecosystem," Tuckner said. "And so a lot of MCP servers are hosted on npm, but they might be used and supported by an IT team." Application security teams historically focused on code while IT security teams managed endpoints and infrastructure, but Aboukhadijeh said these distinctions are becoming less meaningful. Developer workflows now span both domains, making it difficult to assign clear ownership of security. As a result, clients are moving toward unified approaches that provide shared visibility and control across teams. "What buyers want increasingly is a common view of what third-party code and tools are being introduced, where they're running, what they're doing and whether they're safe to use," Aboukhadijeh said. "From our perspective, we just have to have the rightcapabilities, give people visibility, help them have controls and give them policies."

Socket has announced support for the PHP ecosystem, integrating Composer and Packagist into its software supply chain security platform. PHP developers can now search packages, generate Software Bills of Materials from Composer projects, and detect supply chain risks across dependencies. PHP powers roughly 75% of websites with a known server-side language. Packagist hosts over 440,000 packages with more than 169 billion installations since 2012, and Composer downloads exceed 2 billion packages monthly. Socket's AI-powered platform detects zero-day threats, typosquatting, backdoors and obfuscated code beyond traditional vulnerability scanning. Package search and browsing are available immediately, whilst SBOM generation and security scanning are in experimental release. Socket protects 14,000 organisations and 1.2 million repositories, securing over 2 million commits monthly and identifying 1,000 supply chain attacks weekly.

Security firm Socket recently revealed a massive campaign involving over 70 malicious npm and VS Code packages stealing data and crypto.