Introducing Socket Scanning for VS Code Marketplace Extensions

CLI and shared client utilities for Antigravity chat automation

Fine-grained Access Control (ACL) 엔진입니다. 리소스 기반 접근 제어 패턴을 제공합니다.

`@croco/access-core`용 Drizzle 구현체입니다.

PostHog 기반 분석 이벤트 추적 구현체입니다. `@croco/analytics-core`의 `AnalyticsManager` 추상 클래스를 구현하여 사용자 행동, 사용자 식별, 그룹 연결을 PostHog에 전송합니다.

감사 로그 데코레이터, 인터셉터, 무결성 검증 계약을 제공하는 감사 코어 패키지입니다.

`@croco/audit-core`용 Drizzle 감사 로그 저장소입니다.

Better Auth와 Drizzle을 Croco 인증 흐름에 연결하는 패키지입니다.

Clerk Backend SDK를 Croco 인증, 세션, 조직 API에 연결하는 패키지입니다.

RBAC, API 키, 인증 가드, 권한 데코레이터를 제공하는 인증 코어 패키지입니다.

`@croco/auth-core`용 Drizzle 저장소 모음입니다.

대용량 데이터 처리를 위한 배치 프레임워크입니다. Spring Batch의 개념(Reader, Processor, Writer)을 차용하여 Node.js 환경에 맞게 구현했습니다.

배치 Step을 청크 단위로 실행하고 다음 청크를 QStash로 예약하는 실행기입니다.

구독, 체크아웃, 플랜 전환, 통화 계산을 담당하는 빌링 도메인 코어 패키지입니다.

Polar 결제 플랫폼 연동 — checkout, webhook, 구독 관리

Croco 프레임워크용 캐시 추상화 패키지입니다. 인메모리 LRU 캐시, stampede protection, TTL 관리, 패턴 무효화, 분산 캐시 인터페이스를 제공합니다.

Croco CLI is a code generator and project scaffolding tool for Croco framework workspaces. It creates controllers, entities, events, pages, domain modules, and generates RPC clients or OpenAPI specs.

테넌트 건강 점수(Tenant Health Score) 시스템의 핵심 인터페이스와 구현을 제공합니다.

`@croco/customer-health-core`용 Drizzle 구현체입니다.

Request-scoped DataLoader for batching and caching requests. Solves the N+1 query problem in GraphQL and other data-fetching scenarios.

Croco Framework 공식 문서 사이트입니다. Starlight(Astro 기반)로 구축되었습니다.

플랜별 entitlement와 quota 강제를 제공하는 SaaS 기능 제한 코어 패키지입니다.

`@croco/entitlements-core`용 Drizzle 구현체입니다.

esbuild 플러그인 - reflect-metadata 자동 주입 및 @Component 파일 스캔

Blocks malicious packages at install time across 10+ ecosystems — protecting developers before threats reach production. Works out of the box with unlimited packages, flexible deployments, and enterprise-ready self-hosting.

Firewall

Access certified security patches for vulnerable packages, enabling safe upgrades without breaking changes.

Socket Patches

Provides real-time access to curated vulnerability and malware threat data for use in your own tools and workflows.

Threat Feed

License

Maintenance

Miscellaneous

Other

Quality

Supply chain risk

Vulnerability

We may hide one of these components if their impact is neutral, e.g. unknown reachability. When alerts are associated with multiple artifacts, the priority score is based on the artifact with the highest priority score.

Legal

Operational

Security

View organization entitlements and feature access permissions.

View the ID of the Socket organization selected for this connection.

Admins only

Organization members

Dashboard

Artifact: <code>{{- fullArtifactDisplayName}}</code>

Dependency chains

Grouping: Directs

Grouping: None

Dependency tree

Summary with created, updated, and cleared alerts

{{feature}} is not available on your current plan. Upgrade to {{tier}} to access this feature

Unlock powerful security features for your {{tier}}

Upgrade to {{tier}}

<upgradeLink>Upgrade</upgradeLink> to access this feature

Feature locked

Rate your experience

Archive file: {{fileName}}

Achievements

Why Socket?

Blog

Customer Stories

Languages

This will end every active session except the one you're using right now. You'll stay signed in here, but you'll need to sign in again on every other browser and device.

Sign out from all other devices?

Impersonation Mode Active

Update your browser to the latest version for the best experience.

Your web browser is outdated

Update available

Use another browser for the best experience.

Your web browser is unsupported

{{count, number}} commits last two months

{{count, number}} critical severity alert

{{count, number}} critical severity alerts

{{count, number}} dependency vulnerability

{{count, number}} dependency vulnerabilities

{{count, number}} development dependencies

{{count, number}} transitive dependencies

{{count, number}} version published last month

{{count, number}} versions published last month

{{count, number}} version published in last two months

{{count, number}} versions published in last two months

{{count, number}} version published last week

{{count, number}} versions published last week

{{count, number}} version published last year

{{count, number}} versions published last year

Connecting

Socket undergoes annual SOC2 Type II audits. Socket customers can request a copy of the full SOC2 Type II report.

Work with a dedicated Customer Success Manager to help you get the most out of Socket.

Restrict logins to the organization to SSO, preventing other login methods (e.g. GitHub or email)

Have members who are not admins in the organization. Restrict access with Role-based Access Control (RBAC).

Integrates with top AI coding assistants — including Claude Code, Claude Desktop, Gemini Code, and other MCP-compatible agents — to provide real-time dependency insights, vulnerability context, and security scoring directly inside your AI-powered coding environment.

Get a clear view of your current supply chain health. Track active alerts, dependency risk, and security trends across your org—all in one place on the Socket Dashboard and via API.

Allows organization owners and admins to access detailed records of actions taken by members of their organization, complete with timestamps.

Automatically generate fixes for vulnerable dependencies with safe, tested upgrades.

Prevent compromised packages from infiltrating your supply chain by monitoring for changes in real-time. Block 70+ types of open source threats, including malware, typo-squatting, and backdoors.

Shift left by catching risky or low-quality dependencies before they're merged. Use CI gating, PR comments, and visual warnings to guide developers early and enforce security guardrails.

Removes known vulnerabilities instantly without upgrading dependencies. Delivers safe, human-reviewed, AI-validated patches that live in your repo, eliminate risky updates, and keep builds stable while reducing supply chain exposure.

Socket opens pull requests for each patch so developers can review and merge fixes with no extra work.

Receive updated patches as new CVEs and package releases appear, with no extra work.

Patches for the most severe CVEs are free on every plan, and the Socket CLI applies them with no account or signup required. Try the patch quality on the riskiest issues first; if it's good enough for active threats, it's good enough for the rest.

When a dependency has multiple CVEs, Socket diff-merges every applicable patch into a single combined fix. Free users apply patches one CVE at a time; paid plans collapse them into one dependency change, so you remediate the whole package in a single step.

Patches for medium- and lower-severity CVEs, beyond the critical-tier coverage included with every plan. Covers the long tail of vulnerabilities other scanners flag but never actually fix.

Apply any certified patch to your repo with a single click from the Socket dashboard or CLI. No version bumps, no manual diffs, no upgrade roulette.

Focus on vulnerabilities your code can actually hit, then fix them instantly with patches.

Use patches vetted by experienced maintainers so you can remediate confidently. Patches ship with automated behavioral tests to ensure nothing breaks.

Integrate with Slack and Microsoft Teams.

Integrate with Vanta. Drata is coming soon.

Export alert data to your own cloud storage (S3, GCS, Azure Blob).

Scans browser extensions for risk and malware — supports Chrome, Firefox, Edge, and Safari.

Analyzes IDE extensions for security risks — supports OpenVSX and VS Code.

Stops known malware and risky dependencies before they’re downloaded — protecting developer machines and CI/CD pipelines in real time.

Monitor blocked installs, package risks, and usage across all teams directly in your Socket dashboard or via the Socket API.

Configure Socket Firewall to run with private registries or as a chained HTTP proxy for full control of dependency ingress.

Customize whether to block, warn, or allow packages based on your security and license policies.

Works with JavaScript/TypeScript (npm, Yarn, pnpm), Python (pip, uv), and Rust (cargo).

Deploy Socket Firewall in your own infrastructure, with flexible modes for wrapper-only or full network proxy operation.

Open ready-to-review dependency upgrade pull requests directly from the dashboard, delivered through the Socket GitHub App.

Customize parts of the comment sent to developers in GitHub pull requests

See how your security changes over time with 30 days of historical insights. Track alert trends, monitor dependency changes, and export data via API for custom dashboards.

Surfaces security issues directly in IDEs to help developers fix faster while coding. VS Code extension includes a bundled MCP server by default.

Surfaces issues and fixes in the IDE, helping developers catch and resolve problems as they code.

Socket scans for vulnerabilities in your dependencies, including CVEs, security advisories, and more.

Socket supports JavaScript, TypeScript, Python, Go, Java, Ruby, C#, F#, Visual Basic, Scala, Kotlin, Rust, PHP, Swift, C, C++, Julia, Dart, Elixir, and Erlang — with continuous expansion to cover the most popular ecosystems.

Automatically enforce license policies across all repositories, blocking non-compliant dependencies and ensuring your entire organization stays compliant.

Local AI connector that exposes dependency scoring and security context to your tools via a standardized protocol.

Search across your organization's scans and telemetry to find everywhere a given package (PURL) has recently been seen.

Define and enforce custom license policies using repo labels — based on factors like team, criticality, environment, or any criteria you choose.

Define and enforce custom security policies using repo labels — based on factors like team, criticality, environment, or any criteria you choose.

Ranks issues by exploitability, reachability, fixability, and custom priorities set via repo labels.

Faster replies to support questions via email and Slack.

Get dedicated support from technical experts and engineers in a private Slack channel.

Use Socket Web Extension to educate developers at the earliest possible point in time about package risks before they install them on their local development systems. Supports Chrome, Edge, and Firefox.

Import or export Software Bills of Materials (SBOMs) to track and audit dependencies.

Scans AI models on PyPI and HuggingFace for malicious code, backdoors, and other security risks.

Scans GitHub Actions for malicious code, backdoors, and other security risks — protecting your CI/CD workflows from supply-chain attacks.

Automate user provisioning and deprovisioning with SCIM.

Use Socket with a self-hosted source code management (GitHub Enterprise Server, GitLab Enterprise, Bitbucket Server, and Azure DevOps Server..

Inegrate with Elastic, Google BigQuery, Panther, and Splunk.

Socket is SOC2 Type II compliant and undergoes annual audits.

Connects to public registries to scan container images from Docker Hub, ECR, ACR, GCR, and more.

Applies to all scans — whether triggered via API, CLI, IDE, or SCM integrations.

Socket Basics runs SAST on JavaScript, TypeScript, Python, Go, Java, Ruby, C#, Scala, Kotlin, Rust, PHP, Swift, C/C++, Elixir, and Erlang.

Block commits and pushes with secrets using git hooks—before they ever hit your repo.

Detect a wide range of secrets with over 800 built-in detectors covering API keys, credentials, tokens, and more—right out of the box.

The Socket CLI allows teams to prevent risky dependencies from being installed, and to get dependency insights from the command line.

Connects to your source code management system to scan repos, review PRs or MRs, and enrich the developer workflow with security insights.

Socket supports SAML SSO for single sign-on and identity management.

Paid add-on. Provides real-time access to curated vulnerability and malware threat data for use in your own tools and workflows.

Integrate with Jira, Linear, Asana, and ClickUp.

Filters out CVEs in functions your code doesn’t call — reducing up to 90% of false positives and irrelevant CVEs. Full application reachability provides the highest quality reachability data. Easy to setup. Need to add a CLI command to CI/CD or GitHub Action to the repository.

Analyze the reachability of vulnerabilities in your dependencies.

Get up to speed quickly with hands-on training and guided onboarding. Our team helps your developers and security teams hit the ground running.

Receive a Service Level Agreement for uptime of the Socket application.

High-quality comprehensive vulnerability database which integrates proprietary data from Socket, NVD, GitHub, OSV, OpenSSF, and many other sources.

Receive updates via Webhooks anytime Socket has new scan results or alert state has changed.

Generate alert policy rules from natural language using AI.

Create custom tabs in the Alerts page to filter and organize your alerts.

Socket will analyze your SBOMs up to a maximum number of dependencies.

API that allows you to analyze a project, lookup package scores and alerts, and more.

Create API tokens to authenticate with the Socket API and CLI.

View recent supply chain attack campaigns in the Socket Dashboard.

A developer is anyone who’s made a commit to repositories scanned by Socket, excluding external contributors to public repos.

A member is anyone added to your Socket organization dashboard with a role of "member" or higher, giving them access to team settings, security policy, org-wide alerts, and integrations.

Repositories restricted to your organization. Socket scans them securely using the SCM integration, or through the CLI or API.

Repositories that are publicly visible. Socket scans them securely using the SCM integration, or through the CLI or API.

Organize repos by team, project, or importance. Apply custom policies and adjust alert priority based on labels.

View recent threat feed items in the Socket Dashboard.

This organization plan is managed by its external marketplace entitlement and has no Socket or Stripe plan subscription.

Marketplace-managed plan

Enterprise access managed through AWS Security Hub Extended.

For growing teams with enhanced scale, security, and support.

Unlimited scale, self-hosting, and priority support for large teams.

For open-source projects, individuals, and small teams.

This is a legacy plan that is no longer available for new customers. Upgrade to our Team or Enterprise plans for enhanced features and support.

There is a package with a similar name that is downloaded much more often.

There are packages with similar names that are downloaded much more often.

This may not be the package you want!

Instance

Alert Locations

Package

Describe the issue you encountered with this patch. Your feedback will be sent to the Socket patches team.

Report a Problem

Readme not found for selected version

Provide a detailed description of the threat...

Keyboard shortcuts

Tips

Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript, Python, and Go dependencies.

Socket - Secure your dependencies. Ship with confidence.

Upgrade to access this feature and <pricingLink>many more features</pricingLink>.

ddark