How do you detect compromised packages?
What indicators of compromise do you use?
Is Socket itself open source?
Can I run it locally on the command-line?
Socket’s not open source at this time, but we’re releasing a CLI in the coming week if the GitHub App doesn’t suit your purposes.
https://www.youtube.com/watch?v=lZ8s1JwtNas https://github.com/artemdinaburg/bitsquat-script/
https://socket.dev/npm/issue/telemetry https://wiki.debian.org/PrivacyIssues