Socket

Socket is a software supply chain security platform for teams that build on open-source packages, which is to say almost every team. Traditional dependency scanners check packages against lists of known vulnerabilities. Socket also reads the code of each dependency and looks for behaviour that suggests an attack: install scripts, unexpected network or file system access, obfuscated code, typosquatted names and known malware.

The company was founded in 2021 by Feross Aboukhadijeh, an open-source developer known for WebTorrent and StandardJS, and is backed by investors including Andreessen Horowitz and Thrive Capital. Socket reports detecting more than 100 zero-day supply chain attacks every week.

Key features

• 70+ risk signals. Detection covers malware, vulnerabilities, licence problems and suspicious behaviour, with AI analysis that flags hidden dependency behaviour.
• Socket for GitHub. A GitHub App that checks pull requests adding or updating dependencies and comments with any alerts before the change is merged.
• Socket Firewall. Sits between the package manager and the registry and blocks malicious packages, including transitive ones, at install time. The free version wraps npm, yarn, pnpm, pip, uv and cargo with an sfw prefix and needs no API key.
• CLI, editor and API. The Socket CLI produces reports for teams not on GitHub, a VS Code extension shows alerts while coding, and a REST API and JavaScript SDK support custom tooling.
• Reachability analysis. Paid plans check whether vulnerable code is actually reachable from your application, to cut alerts that do not apply.
• Integrations. Alerts can go to Slack, Jira, Microsoft Teams and PagerDuty, and to SIEM tools such as Splunk, Datadog and Microsoft Sentinel; compliance evidence can be sent to Vanta and Drata.

Who it is for

Socket suits developers and small teams who want a free way to stop malicious packages from reaching their machines and CI, and security teams at larger companies who need policy enforcement, SBOMs and SIEM integration across many repositories. JavaScript, Python, Go, Java, Ruby, .NET, Rust, Scala and Kotlin are generally available, with PHP in beta.

Pricing at a glance

• Free: $0 with unlimited developers and repositories, 1,000 scans per month and automatic blocking of malicious dependencies.
• Team: $25 per developer per month (minimum 5), adding reachability analysis, priority scoring and Slack alerts.
• Business: $50 per developer per month (minimum 20), adding SSO, SBOM import and export, webhooks and compliance integrations.
• Enterprise: custom pricing with GitLab, Bitbucket, Azure DevOps and self-hosted repository support, SCIM and audit logs.

Monthly prices are shown; yearly billing saves 20%. Prices as listed at the time of writing (October 2026); check the vendor's pricing page before buying.

Things to consider

• Integrations for GitLab, Bitbucket and Azure DevOps are on the Enterprise plan only.
• Behaviour-based alerts need tuning; expect to set policies for which alerts block, warn or are ignored.
• The free Socket Firewall works only with public registries.

Getting started

1. Create a free account on the Socket pricing page and install the GitHub App on your repositories.
2. Review the alerts on your next dependency pull request and set your security policy.
3. Install Socket Firewall Free or the CLI for local and CI use, following the Socket documentation.