About Socket
Socket offers a developer-first platform that blocks malicious packages before they reach the code of its users. Socket was founded in 2021 to tackle the growing threat of software supply chain attacks.[1][3]
Socket says modern apps rely on thousands of open source packages, and that dependencies are a common hiding place for malicious code. Socket says AI coding tools are accelerating how fast dependencies enter production. Socket describes packages as entering through managers, updates, AI code and transitive installs, often reaching production before teams can review every change. Socket describes CVE databases as tracking disclosed vulnerabilities, not malicious package behavior such as secret theft, exfiltration, install scripts or impersonation.[4]
Socket states that open source makes up 90% of modern application code. Socket scans every package and update for malicious behavior across all major registries. Socket analyzes the behavior of dependencies and provides real-time protection against both known and emerging threats.[1][3]
Socket Firewall blocks malicious packages at install. Socket for GitHub catches risky dependency additions and malicious updates in pull requests before they merge. Socket Reachability filters vulnerability noise by what is reachable from the code. Dependency Search shows security insights for millions of open source packages across every major registry. Socket lets a user look up supply chain risks for a given version of a package in the ecosystem registry.[1][3][5]
An organization is set up in Socket to manage access and protection settings. A GitHub account is connected so that Socket can access and scan the repositories. Customers choose the repositories that Socket protects automatically. Socket can run on a CI/CD pipeline and creates a report for review. Socket creates a project health report for a project. Socket states that source code never leaves the computer or CI environment of the customer, and that only the list of dependencies is sent to Socket's service. Socket counts a developer as someone who made a commit to a repository scanned by Socket in the past 90 days.[5][6]
Socket serves industries including technology, media, healthcare and finance. Socket describes one of its plans as meant for building solo or in a small team.[6]
Socket on the record