Socket

Socket is a software supply chain security platform founded in 2021 by Feross Aboukhadijeh, the open-source maintainer behind projects with over a billion monthly downloads. Instead of waiting for CVEs to be published, Socket proactively analyzes dependency behavior across npm, PyPI, Go, Maven, and other registries — network calls, filesystem access, install scripts, obfuscation, typosquatting, maintainer-takeover signals — and blocks malicious packages before they reach your code. It surfaces findings as PR comments via its GitHub App plus a CLI and VS Code extension, caught most 2025–2026 npm worms within hours, is SOC 2 Type II certified, and has raised $125M. It is free for open-source repositories forever; Team plans run about $20/month.

The honest picture: private repositories beyond the free allowance are billed per developer, and behavioral analysis inevitably produces some false positives that need human review. Socket covers the zero-day window CVE scanners miss, but it complements rather than replaces them — you still want Dependabot or Snyk for known-vulnerability management.

Install the Socket GitHub App or CLI; it automatically scans PRs that touch dependency manifests.