Since adopting Socket for supply chain security, SHI has greatly reduced manual work and human error, improving the speed of critical security checks.

SHI Strengthens Supply Chain Security with Socket: Reducing Manual Work and Human Error

JupiterOne uses Socket to cut false positives, enforce CI/CD policy, and streamline security in a lean, automated, immutable infrastructure.

JupiterOne Secures Immutable Infrastructure with Socket’s Streamlined CI/CD Security

Learn how GAN Integrity is improving its security efforts with Socket's reduction in false positives.

Coana Case Study: How GAN Integrity Cut 90% of Vulnerability Noise to Focus on Real Threats

Learn how Maze uses Socket's reachability analysis to prioritize vulnerabilities, reducing manual work and enhancing efficiency.

Coana Case Study: How Maze Cut Through SCA Noise to Focus on What Really Matters

Learn how Watershed uses Socket's reachability analysis to prioritize vulnerabilities and reduce manual work.

Coana Case Study: How Watershed Eliminated 85% of SCA Noise to Streamline Vulnerability Management

Render scales AppSec effortlessly with Socket’s CI integration, low-noise GitHub alerts, and zero-friction license scanning that developers love. 

How Render Enables Scalable AppSec with Socket

Learn how VeChain enhanced blockchain security and reduced alert fatigue by implementing Socket's real-time dependency scanning.

VeChain Strengthens Blockchain Security with Socket's Real-Time Dependency Scanning

In this case study we discuss how Anthropic was able to scale supply chain security with Socket by automating 95% of dependency reviews, drastically reducing manual security engineering work.


How Anthropic Is Scaling Supply Chain Security with Socket

Learn how Doctolib enhanced their supply chain security and compliance by seamlessly integrating Socket’s automated threat detection into their CI pipeline.

Doctolib Partners with Socket to Automate Supply Chain Threat Detection

TELUS significantly enhances its software supply chain security with Socket, achieving seamless integration into developer workflows, improved threat detection, and proactive risk management.

TELUS Supercharges Software Supply Chain Security with Socket

Replit, an AI-driven software platform, boosted its security and operational efficiency by integrating Socket, which enhances confidence in adding new dependencies due its comprehensive supply chain protection.

Building Secure Code with Confidence: How Replit Uses Socket to Reduce False Positives and Manage Supply Chain Risks

This case study explores how Chia, a prominent blockchain technology startup, used Socket to reduce open security alerts by 70% while improving developer efficiency and compliance.

Enhancing Security and Streamlining Processes: How Chia Achieved a 70% Reduction in Open Security Alerts with Socket

Discover how MetaMask boosts its crypto wallet security by integrating Socket's AI-powered threat detection to proactively identify and manage supply chain security risks.

MetaMask Leverages Socket for Proactive Threat Detection and Simplified Dependency Management

Drata, a security compliance company, partnered with Socket to gain deeper visibility into supply chain risks and empower developers to make informed security decisions.

Raising the Bar: How Drata Fortified Supply Chain Security with Socket

Vercel cut dependency sprawl with Socket, reducing overlapping dependencies and improving open source hygiene. Socket's seamless integration into developer workflows enables them to self-remediate issues and make faster decisions.

Vercel Optimizes Open Source Dependency Management with Socket: Reduced Sprawl, Improved Hygiene, and Faster Decision-Making

Inherit

Block

Ignore

Monitor

Warn

License

Maintenance

Miscellaneous

Other

Quality

Supply chain risk

Vulnerability

When alerts are associated with multiple artifacts, the priority score is based on the artifact with the highest priority score.

Legal

Operational

Security

Admins only

Organization members

Dashboard

Grouping: Directs

Grouping: None

Artifact: <code>{{- fullArtifactDisplayName}}</code>

Dependency tree

<upgradeLink>Upgrade</upgradeLink> to access this feature

Rate your experience

Achievements

Why Socket?

Blog

Customer Stories

Languages

Impersonation Mode Active

Update your browser to the latest version for the best experience.

Your web browser is outdated

Use another browser for the best experience.

Your web browser is unsupported

{{count, number}} commits last two months

{{count, number}} critical severity alert

{{count, number}} critical severity alerts

{{count, number}} dependency vulnerability

{{count, number}} dependency vulnerabilities

{{count, number}} development dependencies

{{count, number}} transitive dependencies

{{count, number}} version published last month

{{count, number}} versions published last month

{{count, number}} version published in last two months

{{count, number}} versions published in last two months

{{count, number}} version published last week

{{count, number}} versions published last week

{{count, number}} version published last year

{{count, number}} versions published last year

Socket undergoes annual SOC2 Type II audits. Socket customers can request a copy of the full SOC2 Type II report.

Allows organization owners and admins to access detailed records of actions taken by members of their organization, complete with timestamps.

Prevent compromised packages from infiltrating your supply chain by monitoring for changes in real-time.

Join our Discord community to get help from Socket engineers and other Socket users.

Compare millions of open source packages on socket.dev

Detect malicious code and risky behavior (e.g. network) in your dependencies using "deep package inspection"

All data is encrypted in transit and at rest using industry standard encryption algorithms.

Get a dedicated Socket account manager and access to Socket's Customer Success team.

Get dedicated support from Socket engineers via email and Slack.

"Shift left" with the Socket Chrome extension and give intervene early, before developers choose risky or low quality dependencies.

Catch developers using risky dependencies and give them a "speed bump" to encourage good behavior

Install the Socket GitHub app to receive real-time dependency scanning and reports with every pull request.

Customize parts of the comment sent to developers in GitHub pull requests

Integrate Socket into your GitHub SCM to prevent risky dependencies from being installed.

Socket scans for vulnerabilities in your dependencies, including CVEs, security advisories, and more.

Socket supports dependencies in many languages, with most popular ecosystems coming in 2024. We've got you covered no matter what languages you use.

Enforce license policies across your organization

Receive a Microsoft Teams message to the channel of your choice anytime Socket runs a new analysis, has a new finding, or a policy has changed.

Get help migrating from Socket's free plan to Socket's paid plans.

Run Socket on-premises or in your own cloud environment.

Query for any dependency (at any version) across your entire organization

Integrate Socket into your CI/CD pipeline to prevent risky dependencies from being deployed to production.

Analyze an entire project to find supply chain risks

Tag projects to organize and filter your projects

Restrict access based on the roles of individual users within an organization.

Receive a Slack message to the channel of your choice anytime Socket runs a new analysis, has a new finding, or a policy has changed.

Socket is SOC2 Type II compliant and undergoes annual audits.

The Socket CLI allows teams to prevent risky dependencies from being installed, and to get dependency insights from the command line.

Socket supports SAML SSO for single sign-on and identity management.

Integrate Socket into your VS Code IDE to prevent risky dependencies from being installed.

Get a POST request anytime Socket runs a new analysis, has a new finding, or a policy has changed.

Socket will analyze your SBOMs up to a maximum number of dependencies.

API that allows you to analyze a project, lookup package scores and alerts, and more.

Create API tokens to authenticate with the Socket API and CLI.

A developer is someone who made a commit to your organization's repositories scanned by Socket.

A member is someone who is a part of your organization and can access your organization's Socket dashboard.

Use Socket to protect your private repositories.

Socket is always free for open source projects.

Socket retains all reporting data for 3 months, 1 year, or a custom term of your choice.

Access the threat feed that powers Socket.

Unlimited scale, self-hosting, and priority support for large teams.

For open-source projects, individuals, and small teams.

For growing teams with enhanced scale, security, and support.

This is a legacy plan that is no longer available for new customers. Upgrade to our Team or Enterprise plans for enhanced features and support.

There is a package with a similar name that is downloaded much more often.

There are packages with similar names that are downloaded much more often.

This may not be the package you want!

Instance

Alert Locations

Package

Readme not found for selected version

Provide a detailed description of the threat...

Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript, Python, and Go dependencies.

Socket - Secure your dependencies. Ship with confidence.

Welcome to Socket

Get actionable alerts for the supply chain risks that matter. Socket highlights risky dependencies directly within the developer workflow.

Not using GitHub? Generate reports next to your tests with our CLI

Socket CLI

Socket detects traditional vulnerabilities (CVEs) but goes beyond that to scan the actual code of dependencies for malicious behavior. It proactively detects and blocks 70+ signals of supply chain risk in open source code, for comprehensive protection.

Detect and block software supply chain attacks

Socket is built by a team of prolific open source maintainers whose software is downloaded over 1 billion times per month. We understand how to build tools that developers love. But don’t take our word for it.

Meet our customers

How top security teams use Socket