Socket
Catching malicious or surprising dependency behavior, not only packages that already have a CVE.
Last updated
- Free tier
- Yes
- Checked
- 2026-10-13
What the public pages say
Socket looks at the packages you install. That is a different question from "does this function forget to check auth." Use it alongside a code review of your own routes, especially if an agent added dependencies you did not read.
The pricing page is detailed and changes. The numbers above are from that page on the checked date.
Free tier
Socket's pricing page lists a Free plan at $0 per developer with unlimited developers and repos, 1,000 scans per month, 500 API requests per hour, 3 members, and 1 repository label. The same bullets say it detects 70+ risk types such as malware, vulnerabilities, and license issues, and that it can block malicious dependencies. The FAQ on that page says Socket is free for open source, and that your source code stays on your machine or in CI: only the dependency list is sent to Socket.
Sources
Markdown version · Canonical page: https://shipsecurely.dev/tools/socket