Socket

What Socket is

Socket is a developer-first security platform for finding and blocking vulnerable or malicious software dependencies. Its GitHub App scans dependency changes in pull requests and provides feedback before a merge. Socket Firewall intercepts package-manager requests to stop malicious direct or transitive dependencies before installation; the free Firewall supports JavaScript and TypeScript package managers, Python pip and uv, and Rust cargo. The platform also offers reachability analysis, which can eliminate up to 90% of irrelevant CVEs through full application analysis. Integrations include AWS CodePipeline, Azure Pipelines, Bitbucket Pipelines, CircleCI, Jenkins, Vanta, and Drata. Developers can use its REST API and JavaScript SDK for custom integrations and automation. Socket says it collects dependency manifests and lockfiles for analysis, not source code, and that server communications use TLS. Its Free plan includes 1,000 scans per month, while open-source projects can use Socket for free. Team costs $25 a month per developer, with a five-developer minimum; Business costs $50 a month per developer, with a 20-developer minimum. The CLI requires Node.js 18.20.8 or newer.