The supply chain is mostly code nobody reads. That is where the research is.
Socket Labs is where Socket works the foundational problems of software supply chain security: research with a live view across the open-source ecosystem, freedom from the product roadmap, and the time horizons real answers need.
Foundational problems, room to pursue them.
Supply chain security still lacks answers to fundamental questions: how to detect malicious packages at ecosystem scale, how detectors hold up against adaptive adversaries, what program analysis can reliably infer from untrusted code, and how agentic tooling changes the attack surface. Socket Labs exists to pursue these questions over the long term. Understanding how malicious code hides, spreads, and evades detection takes depth, careful measurement, and research that goes beyond a single paper or product cycle. Labs works closely with Socket’s threat intelligence team, which tracks live attacks and publishes threat research every week. Their investigations ground our experiments, while our findings sharpen the systems they rely on. What we learn is published openly and feeds back into how Socket protects real developers.
Five questions, on long horizons.
Our work clusters around the foundational layers of the problem. Each is a research program, not a feature.
Malicious package detection at ecosystem scale
Socket’s threat intelligence team finds malicious packages daily. Together we study the science underneath: detection methods fast enough to stop attacks before install, accurate at scale.
Adversarial robustness and evasion
Obfuscation, polymorphism, and the arms race against detectors. We attack our own systems, LLM ones included, to find where they break before adversaries do.
LLM and agentic security
Coding agents install dependencies on their own, and the attack surface moves with them. We study prompt injection, malicious MCP servers, and what breaks when an agent pulls untrusted code.
Program analysis for behavior
Reasoning about what code does, not what it claims. Capability detection, reachability, and slicing malicious behavior from the noise at a scale where every analysis pays for itself.
Emerging ecosystems
Browser extensions, OpenVSX, AI skills, MCP servers. Every new registry is a new supply chain with the same old problems, and the advantage goes to whoever maps the terrain first.
Socket Labs has been one of the best experiences of my career. I’ve had the chance to explore interesting research ideas and test them on real systems, using unique datasets that simply wouldn’t exist anywhere else. I get to work alongside research experts, advisors, and some of the best engineers I’ve seen. Everyone is incredibly kind, approachable, and eager to help.
The rare place to do this work well.
Data you cannot get in a lab
Live visibility into packages published across npm, PyPI, Maven, Go, and Cargo, not a snapshot others approximate.
Real adversaries, not benchmarks
Socket’s threat intel catches real attackers as they happen, so detectors face the real thing, not approximations.
Expert labels, not scraped ones
Every confirmed attack is human-reviewed, giving Labs expert-labeled real malware, the rarest resource in detection.
Freedom to be early
Chase the question first, let usefulness catch up. Time horizons set by the problem, not the sprint, and findings ship in the open.
Impact and publication
Results ship to developers and top venues (IEEE S&P, USENIX, CCS, NDSS), advancing the field and protecting its users.
Strong peers, real mentorship
Work with researchers who publish at venues you read, with real mentorship for interns and early-career researchers.
Alexandros Kapravelos, Head of Research
Socket Labs is led by Alexandros Kapravelos, Head of Research at Socket and Associate Professor of Computer Science at NC State University. His research spans software supply chain security, web and browser security, and the security of AI systems. With the Order of the Overflow, he organized DEF CON CTF, the oldest and most prestigious Capture the Flag competition in security, for four years (2018-2021). His honors include the NSF CAREER Award (2021), two Distinguished Paper Awards at the IEEE Symposium on Security and Privacy, and a Distinguished Paper Award at the Network and Distributed System Security Symposium (NDSS).
Work that holds up as science.
Come work on the hard part.
We are hiring security researchers, research engineers, and PhD interns who want to do work that holds up as science and ships to real developers.
Publish and ship
For researchers and research engineers who want both. Backgrounds in program analysis, ML and LLM security, systems security, or large-scale measurement stand out. A PhD is welcome but not required; curiosity and rigor are.
A real problem, real data
Our research internship runs year-round. Spend a few months on a genuine open question at ecosystem scale, with the data, the mentorship, and the freedom to produce work you can publish and defend.
Collaborate with us
We collaborate with academic groups and host visiting researchers. If your work touches supply chain security, program analysis, or AI security, reach out at labs@socket.dev and let us find the overlap.
