Socket for GitHub

Secure every GitHub PR from vulnerable and malicious dependencies

Socket comments in your pull requests when it finds problems in dependencies introduced.

socket-securityBot

Caution

Review the following alerts detected in dependencies.According to your organization's Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action

Severity

Alert (click "" to expand/collapse)

Block

Malicious package: npmhttp

View full report

Set Up Socket

Set up GitHub repository scanning in a few clicks

Socket is the easiest security product youve ever installed.

01
Company name
Job title
Organization name
Create organization
Set up your organization in Socket to manage access and protection settings.
02
Authorize with GitHub
Connect your GitHub account to allow Socket to access and scan your repositories.
03
frontend-app412 deps
api-server30 deps
mobile-client412 deps
data-pipeline67 deps
Pick repositories
Choose the repositories you want Socket to automatically protect.

Socket is one of the most interesting approaches to supply chain security. If you are interested in the risks of malicious deps in your apps, I definitely recommend taking a look at Socket!

[Devdatta Akhawe]

Devdatta AkhaweHead of Security, Figma

Add dependency #482

Open

by @author

"dependencies": { + "utils-extra": "2.2.0"

utils-extrav2.2.0

Network Calls

Obfuscated Code

Merging is blocked

Why use Socket for GitHub

Complete security of your projects in every GitHub PR

Create project health reports
Socket creates a project health report for your project. Uploads your package.json or package-lock.json.
Secure your PR workflow
Run Socket on your CI/CD pipeline to create branches and deploy requests. Socket will create a report for you to review.
Lookup package risks
Socket allows you to look up supply chain risks for a given version of a package in the ecosystem registry.

Get Started