Socket, a San Francisco software supply-chain security company, said on 28 April 2026 that it had acquired Secure Annex, a small company that monitors the browser and code-editor extensions installed across an organisation and flags those that behave in risky or malicious ways.
Terms were not disclosed. Secure Annex was founded and run by security researcher John Tuckner, who was its only employee and joined Socket as part of the deal.
Socket said the purchase would carry its protection beyond open-source packages into browser and editor extensions, MCP servers, AI skills and other tools that developers and employees install. It is Socket's second acquisition, after it bought Coana, a reachability analysis company, in 2025.
What Secure Annex built
Secure Annex gives security teams an inventory of the extensions running in their organisation's browsers and editors, tracks how those extensions change over time and highlights changes that could create security risk. According to byteiota, its detection relies on heuristics that look at how an extension activates, which privileged capabilities it declares and whether it carries obfuscated code that runs when a workspace is opened.
Tuckner started the company in November 2024, byteiota reported, after finding several malicious extensions for Microsoft's VS Code editor. His research has focused on browser extensions, developer tools and the way attackers use updates and changes of account ownership to push malicious code to existing users. byteiota said he coined the term "ransomvibing" for AI-generated extensions with ransomware capabilities that were uploaded to Microsoft's official marketplace.
Despite its size, Secure Annex had paying customers in consumer technology, security, fintech and industrial software. The announcement named Reddit, Brave, Torq and Movable Ink.
“I started Secure Annex after watching extensions become a major attack surface. Most organizations had no visibility into what they were installing.”
Why Socket is buying
Socket built its business scanning open-source dependencies, such as npm and PyPI packages, for malicious behaviour before developers install them. It said it protects more than 14,000 organisations, including Anthropic, xAI, Replit, Cursor, Figma, Vercel, Gusto, Mercado Libre and Cribl, covers 1.2 million code repositories and 2 million commits a month, and helps stop more than 1,000 supply-chain attacks each week.
Founder and chief executive Feross Aboukhadijeh said more of the software people use every day now arrives through extensions and tools rather than packages, and that because these are easy to install and easy to trust they can leave organisations with blind spots. Socket pointed to its own recent research, which linked 108 Chrome extensions to data theft and session hijacking and tied 73 malicious Open VSX extensions to a campaign known as GlassWorm.
Tuckner said the problem was no longer only a developer issue or only an IT issue, since each compromised extension gives attackers a new route across organisations. He said joining Socket would let his work become part of a broader product.
What happens to customers
Socket did not say whether Secure Annex will remain a separate product or how existing Secure Annex customers will be migrated. The announcement described the deal as an extension of Socket's platform into new categories of software rather than a standalone business line.
byteiota characterised the deal as a capability purchase, aimed at a gap that Socket's package-focused scanning engine did not cover, rather than a hire made only for talent.
Socket also did not disclose how many Secure Annex customers were moving across, or whether the extension monitoring would be priced separately from its existing products.
A busy period for Socket
The acquisition came during a period of fast growth for Socket. byteiota reported the following month that the company had raised a $60 million Series C led by Thrive Capital, with Andreessen Horowitz and Capital One Ventures taking part, at a valuation of $1 billion. That brought its total funding to $125 million, and byteiota said the number of protected organisations had reached 27,000.
Secure Annex's own funding history was not reported, and the companies did not say whether it had outside investors.
