Introducing Socket Firewall: Free, Proactive Protection for Your Software Supply Chain

这是超级美眉用于服务端解析html模块

这是超级美眉图片无损压缩帮助类模块，用于压缩图片方便传输预览

基础服务类 - 所有服务类的基类，提供统一的生命周期管理、事件系统和配置管理

这是超级美眉cache帮助函数模块，一个简单的内存+硬盘缓存

一个轻量级的本地缓存类库，提供与Redis兼容的API接口，支持过期时间设置、哈希表操作、数值操作、字符串操作等功能，以及完整的事件通知系统和多文件持久化功能。

这是超级美眉QQ+微信机器人框架，用于开发个人微信聊天、群管机器人

这是超级美眉check参数验证模块，用于验证参数是否正确

这是一个可以将数学公式转成js，并计算的模块。

这是超级美眉配置同步器,用于更改配置同步保存为JSON文件

这是超级美眉游戏连接器，用于连接客户端和服务端，实现前后端安全通讯。

这是超级美眉用于复制文件或目录的模块

这是超级美眉模板消息加解密模块，用于微信、MM应用的加密解密

这是超级美眉es6标准代码转amd的帮助函数模块，还同时将es6标准代码转es5，支持vue

这是一个事件机制, 用于构建网站路由事件、游戏事件、实现对消息拦截、分发、修改、记录、统计

这是超级美眉用来快速读写excel的拓展库

这是超级美眉原型函数拓展模块，更有利于对string、array、object的操作，避免出错，简化业务逻辑。

这是超级美眉服务端框架，用于快速构建应用。

git代码仓库自动部署、热更新到服务器管理工具

这是将html转为vue的功能模块，帮助快速构建vue项目

这是超级美眉http请求帮助类模块，可自动补充cookie，实现模拟登录，通讯

这是超级美眉JSON数据增删改查引擎，方便多人在线游戏、大型活动下处理有用户、角色数据

Inherit

Block

Ignore

Monitor

Warn

License

Maintenance

Miscellaneous

Other

Quality

Supply chain risk

Vulnerability

When alerts are associated with multiple artifacts, the priority score is based on the artifact with the highest priority score.

Legal

Operational

Security

Admins only

Organization members

Dashboard

Grouping: Directs

Grouping: None

Artifact: <code>{{- fullArtifactDisplayName}}</code>

Dependency tree

Summary with created, updated, and cleared alerts

<upgradeLink>Upgrade</upgradeLink> to access this feature

Rate your experience

Archive file: {{fileName}}

Achievements

Why Socket?

Blog

Customer Stories

Languages

Impersonation Mode Active

Update your browser to the latest version for the best experience.

Your web browser is outdated

Use another browser for the best experience.

Your web browser is unsupported

{{count, number}} commits last two months

{{count, number}} critical severity alert

{{count, number}} critical severity alerts

{{count, number}} dependency vulnerability

{{count, number}} dependency vulnerabilities

{{count, number}} development dependencies

{{count, number}} transitive dependencies

{{count, number}} version published last month

{{count, number}} versions published last month

{{count, number}} version published in last two months

{{count, number}} versions published in last two months

{{count, number}} version published last week

{{count, number}} versions published last week

{{count, number}} version published last year

{{count, number}} versions published last year

Socket undergoes annual SOC2 Type II audits. Socket customers can request a copy of the full SOC2 Type II report.

Work with a dedicated Customer Success Manager to help you get the most out of Socket.

Control who are admins in the organization. Restrict access with Role-based Access Control (RBAC).

Restrict logins to the organization to SSO, preventing other login methods (e.g. GitHub or email)

Connect your AI code agents to Socket to get security insights and alerts.

Get a clear view of your current supply chain health. Track active alerts, dependency risk, and security trends across your org—all in one place on the Socket Dashboard and via API.

Allows organization owners and admins to access detailed records of actions taken by members of their organization, complete with timestamps.

Automatically generate fixes for vulnerable dependencies with safe, tested upgrades.

Prevent compromised packages from infiltrating your supply chain by monitoring for changes in real-time. Block 70+ types of open source threats, including malware, typo-squatting, backdoors, and more.

Shift left by catching risky or low-quality dependencies before they're merged. Use CI gating, PR comments, and visual warnings to guide developers early and enforce security guardrails.

Integrate with Slack. Microsoft Teams is coming soon.

Integrate with Vanta. Drata is coming soon.

Filters out CVEs in functions your code doesn’t call — reducing up to 90% of false positives and irrelevant CVEs. Tier 1 reachability provides the highest quality reachability data. Easy to setup. Need to add a CLI command to CI/CD or GitHub Action to the repository.

Customize parts of the comment sent to developers in GitHub pull requests

See how your security changes over time with 30 days of historical insights. Track alert trends, monitor dependency changes, and export data via API for custom dashboards.

Analyzes IDE extensions for security risks — supports OpenVSX and VS Code. Coming soon.

Surfaces security issues directly in IDEs to help developers fix faster while coding. VS Code extension includes a bundled MCP server by default.

Surfaces issues and fixes in the IDE, helping developers catch and resolve problems as they code.

Socket scans for vulnerabilities in your dependencies, including CVEs, security advisories, and more.

Socket supports JavaScript, TypeScript, Python, Go, Java, Ruby, .NET, Scala, Kotlin, Rust, and more — with continuous expansion to cover the most popular ecosystems.

Automatically enforce license policies across all repositories, blocking non-compliant dependencies and ensuring your entire organization stays compliant.

Local AI connector that exposes dependency scoring and security context to your tools via a standardized protocol.

Define and enforce custom license policies using repo labels — based on factors like team, criticality, environment, or any criteria you choose.

Define and enforce custom security policies using repo labels — based on factors like team, criticality, environment, or any criteria you choose.

Ranks issues by exploitability, reachability, fixability, and custom priorities set via repo labels.

Faster replies to support questions via email and Slack.

Get dedicated support from technical experts and engineers in a private Slack channel.

Use Socket Web Extension to educate developers at the earliest possible point in time about package risks before they install them on their local development systems. Supports Chrome, Edge, and Firefox.

Analyze the reachability of vulnerabilities in your dependencies.

Import or export Software Bills of Materials (SBOMs) to track and audit dependencies.

Scans AI models in HuggingFace and PyPI packages for malicious code, backdoors, and other security risks. HuggingFace support coming soon.

Automate user provisioning and deprovisioning with SCIM. Coming soon.

Use Socket with a self-hosted source code management (GitHub Enterprise Server, GitLab Enterprise, Bitbucket Server, and Azure DevOps Server..

Inegrate with Elastic, Google BigQuery, Panther, and Splunk.

Socket is SOC2 Type II compliant and undergoes annual audits.

The Socket CLI allows teams to prevent risky dependencies from being installed, and to get dependency insights from the command line.

Connects to your source code management system to scan repos, review PRs or MRs, and enrich the developer workflow with security insights.

Socket supports SAML SSO for single sign-on and identity management.

Paid add-on. Provides real-time access to curated vulnerability and malware threat data for use in your own tools and workflows.

Integrate with Jira and Linear. Coming soon.

Get up to speed quickly with hands-on training and guided onboarding. Our team helps your developers and security teams hit the ground running.

Receive a Service Level Agreement for uptime of the Socket application.

High-quality comprehensive vulnerability database which integrates proprietary data from Socket, NVD, GitHub, OSV, OpenSSF, and many other sources.

Scans browser extensions for risk and malware — supports Chrome, Firefox, Edge, and Safari.

Receive updates via Webhooks anytime Socket has new scan results or alert state has changed.

Create custom tabs in the Alerts page to filter and organize your alerts.

Socket will analyze your SBOMs up to a maximum number of dependencies.

API that allows you to analyze a project, lookup package scores and alerts, and more.

Create API tokens to authenticate with the Socket API and CLI.

A developer is someone who made a commit to your organization's repositories scanned by Socket.

A member is someone who is a part of your organization and can access your organization's Socket dashboard.

Use Socket to protect your private repositories.

Socket is always free for open source projects.

Organize repos by team, project, or importance. Apply custom policies and adjust alert priority based on labels.

Applies to all scans — whether triggered via API, CLI, IDE, or SCM integrations.

Access the threat feed that powers Socket.

For growing teams with enhanced scale, security, and support.

Unlimited scale, self-hosting, and priority support for large teams.

For open-source projects, individuals, and small teams.

This is a legacy plan that is no longer available for new customers. Upgrade to our Team or Enterprise plans for enhanced features and support.

There is a package with a similar name that is downloaded much more often.

There are packages with similar names that are downloaded much more often.

This may not be the package you want!

Instance

Alert Locations

Package

Readme not found for selected version

Provide a detailed description of the threat...

Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript, Python, and Go dependencies.

Socket - Secure your dependencies. Ship with confidence.

Upgrade to access this feature and <pricingLink>many more features</pricingLink>.

qiuwenwu