That's not the technical report; it's also just a blog article which links to someone else's paper, and finishes off by promoting something: "Socket addresses

That's not the technical report; it's also just a blog article which links to someone else's paper, and finishes off by promoting something: "Socket addresses this exact problem. Our platform scans every package in your dependency tree, flags high-risk behaviors like install scripts, obfuscated code, or hidden payloads, and alerts you before damage is done. Even if a hallucinated package gets published and spreads, Socket can stop it from making it into production environments."