The Package Was Fine Six Minutes Ago

A software dependency is a tiny act of faith disguised as a line of text. A developer types a package name, presses return, and acquires code written by strangers, plus code chosen by those strangers, plus code chosen by the strangers they trusted. The package manager responds with cheerful efficiency. Hundreds of files arrive. Nobody reads them. Everyone gets lunch.

Feross Aboukhadijeh had lived inside this arrangement for years. He created and maintained more than 100 npm packages. While his small team was building Wormhole, an encrypted file-transfer service, the familiar chore of choosing and updating dependencies began to look less like housekeeping and more like airport security run on the honor system. The usual options were absurdly mismatched: pay people to audit every line, or install the code and hope.

Socket came out of the space between those choices. Founded in 2021, it began with a GitHub App that watched dependency changes in pull requests. Its premise was simple enough to sound obvious after somebody said it: a vulnerability and an attack are not the same event. A vulnerability may be an accident catalogued later. Malware is deliberate, and by the time a public database knows its name, the package may already be in production.

A fire alarm for code nobody reads

Traditional software composition analysis is good at matching a dependency version against a list of known CVEs. That is useful and late. Socket instead looks for behavior: an install script that appeared in a patch release, a new network connection, shell execution, filesystem access, obfuscated code, a typosquat, a sudden handoff to a new publisher. None proves evil by itself. Together, and especially when newly introduced, they tell a story worth interrupting.

The key word is while. Socket comments inside GitHub pull requests. Its Firewall wraps npm, pip, cargo, and other package managers and can stop a download before it reaches a laptop or CI runner. Alerts can travel to Slack or Microsoft Teams. Its MCP server lets an AI assistant score a dependency, inspect the published files, review organizational alerts, and question the threat feed. The dashboard matters, but the business is really about getting out of the dashboard.

“We needed a solution.”Socket’s wonderfully plain account of the Wormhole years

What failed first was the clock

Socket did not win its argument by proving every old scanner useless. It found the moment those scanners were designed to miss. In a live supply-chain attack, disclosure arrives after publication, and publication may be enough. A package can be updated, pulled into a build, and deployed before a CVE exists. The first system to fail is not necessarily the scanner. It is the assumption that defenders have time.

The Axios compromise made the point with unusual neatness. Socket says its detection systems flagged the malicious dependency within six minutes of publication. More than 2,000 organizations onboarded during the following 24 hours. The episode is also a tidy answer to what changed the company's mind: not one theatrical breach, but years of maintainer experience followed by a repeating pattern. Attackers kept doing recognizable things after gaining control of a package. Those behaviors could be detected before the industry finished naming the incident.

By May 2026, Socket said it secured 11.6 million commits a month and served more than 27,000 organizations, up from 7,500 at its October 2024 Series B. Named customers include Anthropic, xAI, Replit, Cursor, Vercel, Figma, Gusto, Mercado Libre, Cribl, Webflow, Doctolib, MetaMask, Drata, and Chia. Thrive Capital led a $60 million Series C at a $1 billion valuation, bringing total funding to roughly $125 million.

The quieter trick is deleting work

Detecting more problems creates its own failure mode. Security teams already have queues full of plausible danger. In April 2025, Socket acquired Coana, a reachability-analysis company built around research from Aarhus University. Reachability asks whether an application's code can actually call the vulnerable function buried in a dependency. If there is no path, the CVE may be real in the abstract and irrelevant to this program.

Socket says precomputed reachability can remove about 60 percent of vulnerability noise without touching private source code. Full-application analysis scans the application locally and typically removes about 80 percent, sometimes more than 90 percent. There is a tradeoff: it needs setup and compute, and a large scan can take several minutes. The engine also errs toward caution. An uncertain path is marked reachable or unknown, not magically safe.

That distinction explains where Socket sits in the market. Snyk, Mend, Black Duck, Endor Labs, Sonatype, JFrog, and GitHub's Dependabot all overlap in different ways. Socket's sharpest edge is the combination of package behavior, live threat intelligence, install-time blocking, and function-level reachability. It is not automatically a replacement for every AppSec tool. Teams needing first-party code analysis, secrets scanning, or container coverage either use Socket Basics, which orchestrates other scanners, or keep a broader stack.

The bill follows the developers

Socket sells the platform as freemium B2B software. The public pricing is unusually legible for security tooling. A developer counts as active after committing to a scanned repository in the previous 90 days. Open-source projects can request the Business plan free, a distribution choice that also places Socket near the maintainers most likely to see an attack first.

For some buyers, the procurement route is as interesting as the price. Socket joined the AWS Security Hub Extended plan in August 2026, allowing committed AWS spend to cover the product. Its Firewall option there charges by unique artifact checked, not bandwidth or repeated installs. A lockfile with 200 pinned packages installed a million times counts as 200 artifacts. It is a small pricing idea with a useful moral: do not punish a customer for building often.

The part worth stealing

Socket's transferable playbook is not “add AI” or “sell fear.” It is much more practical. Find the moment when a bad decision is still cheap to reverse. Put evidence there. Publish enough of the underlying research to earn trust. Separate malicious intent from accidental vulnerability. Then remove the irrelevant work so the important alert gets a human being.

The approach works best where organizations use lots of third-party code, can enforce policy in source control or package-management workflows, and have enough development activity for early intervention to matter. It is less complete for closed-source vendor binaries, bespoke first-party flaws, runtime-only attacks, or teams that cannot change their build process. Behavior signals can also be ambiguous: a networking library is supposed to use the network. Policies need context, exceptions, and an owner.

That caveat does not weaken the idea. It locates it. Socket is building a checkpoint for code that crosses an organizational boundary while pretending not to. The package was free. The installation was instant. The trust decision was real.