ToolSocket/10 trustMetrics-checked
Socket
Supply-chain security — catches malicious packages before they run.
About
Socket (socket.dev) is the supply-chain security platform: it detects malicious npm/PyPI packages — typosquats, protestware, compromised maintainers — before they execute.
The 2026 reality is that dependency attacks are routine; Socket is the layer that watches the packages themselves, not just their CVEs.
What it can do
- Malicious package detection
- Typosquat protection
- PR alerts
- Supply-chain focus
- CLI + GitHub app
Setup
- Sign up at socket.dev.
- Install the GitHub app or CLI.
- Get alerts on risky packages in PRs.
Prerequisites
GitHub-connected repos.
Use cases
codeautomation
Works with
Generic APIAny agent (.md)
Trust score — 7/10
/10 trustMetrics-checked
Scored 7/10 (metrics tier). Important supply-chain niche with a real product, but narrower than Snyk/Semgrep and proprietary with provider-estimated adoption. Metrics tier.
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 7.0/10
- Maintenance · recency, releases, issue load
- 7.0/10
- Openness · license + docs
- 4.5/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · provider-tier estimate — thinner evidence (no public adoption metric)
- · supply-chain security; no public repo — adoption estimated
- · released 285 days ago
- · manual review: Socket — detects malicious packages (typosquats, protestware); supply-chain focus; license: proprietary
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.