Code & dependency security
Socket
Scans open-source packages for malicious behavior and blocks risky dependencies before they are installed or merged.
Pricing as seen
See site.
Checked 16 Oct 2026. Prices change. Confirm on the vendor site before you buy.
Pricing sourceUpdated
16 Oct 2026
Added
16 Oct 2026
Supported builders
Use it where packages are installed from a lockfile you control: Cursor, Claude Code, Windsurf, v0, and Replit. Hosted builders fit after you can see package.json and run installs yourself.
What it is
Socket’s homepage says it blocks malicious packages before they reach your code, and that it scans packages and updates across major registries. The GitHub app flags risky dependency additions in pull requests.
That is a different job from “this version of lodash has a CVE.” Socket is aimed at install-time supply-chain attacks: a new maintainer, a typosquat, an install script that phones home. AI coding agents add dependencies quickly, which is the scenario this is built for.
Best for: Any app whose agent is allowed to add npm, PyPI, or similar packages without a human reading the diff.
Watch-outs
- It is supply-chain detection, not a web-app scanner.
- Free versus paid limits: See site.
Our take
Opinion from ShipSafeStack. Not a score, not a certification, and not a sponsorship.
One of the few tools that matches how AI agents actually fail: they npm-install a plausible name. Turn on the GitHub check before you let an agent merge dependency bumps. It will not find a missing auth check in your own route.