Socket
Socket is a developer-first software supply chain security platform that protects applications from malicious dependencies, vulnerable packages, license risk, and supply-chain attacks across ecosystems including npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems. It uses deep package analysis across more than 70 alert categories, covering things like typosquats, obfuscated install scripts, unexpected network calls, and crypto-wallet-targeting code.
Beyond detection, Socket offers reachability analysis to cut false positives by identifying which flagged dependencies are actually executed, plus SBOM export in CycloneDX/SPDX/OpenVEX formats, diff scans on pull requests, and a triage workflow. It ships as a hosted API, CLI, GitHub App, IDE extensions, and a package-installer firewall proxy, with integrations for GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Slack, and Microsoft Teams.