Socket
Catches malicious open-source packages by behaviour, before they merge
Overview
Socket is a supply-chain security service that inspects what open-source packages actually do, including install scripts, obfuscation and network access, and blocks malicious or risky dependencies in pull requests, the CLI and at install time. It covers npm, PyPI, Go, Maven and other ecosystems plus editor extensions, with a free plan and per-developer paid tiers.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 14 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- Unlimited developers and repos
- 1,000 scans a month and 500 API calls an hour
- Detection of 70+ risk types
- Automatic blocking of malicious dependencies
- AI analysis that flags hidden dependency behaviour
- 5,000 scans a month and 2,500 API calls an hour
- Precomputed reachability analysis
- Priority scoring
- Slack alerts for new malware or vulnerabilities
- 10,000 API calls an hour
- Compliance integrations such as Vanta
- SBOM import and export
- SSO/SAML and webhook automation
- Scanning of GitHub Actions and AI models
- Function-level reachability analysis
- GitLab, Bitbucket, Azure DevOps and self-hosted repos
- SCIM provisioning, audit logs and IP restrictions
- Private Slack channel and named account manager
What you can produce with Socket
- Pull-request alerts and blocking for malicious or risky dependencies through the GitHub App
- Behavioural flags for install scripts, obfuscation and network access across 70+ risk types
- AI analysis of package code for hidden behaviour, on every plan
- Install-time blocking of malicious packages with Socket Firewall
- Reachability analysis that filters out CVEs your code never calls (paid plans)
- SBOM import and export, SSO/SAML and webhooks on Business; SCIM and audit logs on Enterprise
- Scanning of browser and VS Code extensions, GitHub Actions and AI models
Socket fills the gap CVE scanners leave: it reads package behaviour, so a freshly published malicious version can be blocked before anyone has written an advisory. AI analysis and malware blocking are on the free plan, the GitHub App makes rollout quick, and Team at $25 per developer per month adds reachability analysis that Socket says removes 60% of CVE false positives.
Growth and attack-blocking figures are Socket's own, and it is a supply-chain tool rather than a full application-security suite, so pair it with SAST. For any team shipping JavaScript or Python, the free plan is worth installing.
What we found
Socket is a supply-chain security service for open-source dependencies, set up in 2021 by Feross Aboukhadijeh, an open-source developer known for WebTorrent and StandardJS. Its premise is that vulnerability scanners look in the wrong place for the attacks that matter now. A CVE database only learns about a malicious package after someone reports it, so Socket instead inspects what each package actually does, such as install scripts, obfuscated code and network calls, and flags or blocks it before it reaches a codebase. Since March 2023 it has also run packages through AI models, an approach it first described as ChatGPT-powered threat analysis; the pricing page now calls it AI analysis that flags hidden dependency behaviour, and it is on the free plan.
Delivery is mostly a GitHub App that comments on pull requests, a CLI and IDE plugins, with Socket Firewall blocking malicious packages at install time. Coverage now extends past npm and PyPI to Go, Maven, Cargo, NuGet and RubyGems, plus browser and VS Code extensions and GitHub Actions.
The figures behind its reputation are Socket's own. Announcing a $60 million Series C in May 2026 at a $1 billion valuation, led by Thrive Capital, it said customer organisations had grown from 7,500 to more than 27,000 since October 2024 and that it blocks over 10,000 supply-chain attacks a week. Total funding is $125 million.
Pricing is public. The free plan covers unlimited developers and repositories with 1,000 scans a month. Team is $25 per developer per month billed monthly, with a five-developer minimum, adding reachability analysis, priority scoring and Slack alerts. Business is $50 with a twenty-developer minimum, adding SSO, SBOM export and 10,000 API calls an hour; earlier versions of this page said Business had no quotas, which is wrong. Yearly billing saves up to 20%, and open-source projects stay free. Socket is not a full SAST or SCA suite, so it sits alongside those tools rather than replacing them.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Socket's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Socket unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Socket directly →
Spotted something out of date? Suggest an update →
Socket in the news
Alternatives to Socket
More in Security & Safety
