Socket

Score dependencies for supply-chain risk.

Socket scores software packages for risk across npm, PyPI, Go, Maven, Cargo, Gem, NuGet, Composer, and GitHub Actions, rating each on supply-chain, quality, maintenance, vulnerability, and license dimensions. Use it to vet a dependency before it is adopted — catching typosquats, abandoned packages, and malicious code at the point where a package is proposed rather than after it is already in the build.