About the job
About Us
At Socket, we empower developers and security teams to accelerate their workflows by eliminating tedious security tasks. Our platform is trusted by thousands of organizations, including industry leaders like Anthropic, xAI, Figma, and Vercel, who appreciate our commitment to open source safety. Discover more about their experiences on our social media channels.
Founded by Feross Aboukhadijeh, a distinguished open source maintainer whose software reaches over a billion downloads monthly, Socket has successfully raised $65M in funding from prominent investors and security experts.
About the Role
As a Research Intern, you will partner with elite software engineers to develop innovative defenses against software supply chain threats. This is a unique internship that allows you to convert pioneering research concepts into practical systems that protect millions of developers globally. You will engage in designing and implementing extensive data collection and analysis frameworks, conducting thorough investigations into malicious activities within open source ecosystems, and prototyping cutting-edge techniques for fraud detection on platforms like GitHub.
This role not only pushes the envelope in software supply chain security but also enables you to influence the culture and strategic direction of a rapidly growing security firm. It is ideally suited for PhD candidates who are excited to merge academic knowledge with practical applications and gain invaluable development experience in a mission-driven environment.
What You'll Do
Conduct applied research on emerging software supply chain threats (e.g., typosquatting, dependency confusion, and malicious maintainers) and transform findings into detection prototypes.
Design and assess innovative algorithms to identify malicious or inauthentic activities across ecosystems including npm, PyPI, and GitHub.
Utilize data science and machine learning methodologies to model suspicious publishing behaviors, coordinated activities, and fraud campaigns.
Create automated research tools to collect, transform, and analyze large-scale datasets from third-party APIs (e.g., npm, GitHub, PyPI).