Socket
Shares rank 7 of 10 vulnerability scanners by recommenders
Scans open source packages for malware and suspicious behavior, and people say it spots new malicious versions quickly. Common caveat: noisy alerts.
Scans open source packages for malware and suspicious behavior, and people say it spots new malicious versions quickly. Common caveat: noisy alerts.
11 people gave an opinion
- recommend it
- 7
- criticize it
- 4
- approval share
- 64%
Recommended in 6 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 7 people recommend itNeeds 10 or more, not met.
- 1.7 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Accurately tracks malware implant changes
“The only other ones I've observed during the last week that seem to be able to track this malware implant's changes were socket.dev.”
Comment from 14 Jun 2026 in “Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Packages” “The only ones actually re-identifying the malware implants as miasma malware samples correctly were the socket.dev folks.”
Comment from 23 Jun 2026 in “Package Managers need global hooks” Fast detection of new malware
“Socket.dev, StepSecurity both close a gap here by spending tokens to scan new popular packages”
Comment from 16 May 2026 in “'No Way to Prevent This,' Says Only Package Manager Where This Regularly Happens” “Socket catching it in 6 minutes is impressive”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
Other vulnerability scanners people recommend
The four most recommended other vulnerability scanners, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OpenAI Codex Security | 21 | 30 | 41% | 4 | — | — |
| govulncheck | 13 | 0 | 100% | 9 | — | Approved |
| AISLE | 11 | 2 | 85% | 5 | — | Approved |
| Trivy | 10 | 23 | 30% | 5 | — | — |
| SocketThis page | 7 | 4 | 64% | 6 | — | — |
What people said
12 of the 13 comments that mention it, newest first. Each links to the original comment.
“Even our socket.dev scans returned nothing related to vulnerability”
“This is wrong: the function documents its safety conditions”
“they tell you that they will not read your code, only the requirements.txt and package.json type of files”
“I like the approach Socket is taking, they are bringing the AV security tactics with signatures and active monitoring, to code repos”
“The only ones actually re-identifying the malware implants as miasma malware samples correctly were the socket.dev folks.”
“The only other ones I've observed during the last week that seem to be able to track this malware implant's changes were socket.dev.”
“Socket.dev, StepSecurity both close a gap here by spending tokens to scan new popular packages”
“They're good at it, but it's pointless if everyone keeps downloading packages just minutes after they're published.”
“Snyk and socket.dev take money for the pain and suffering”
“Socket catching it in 6 minutes is impressive”
“Socket had to introduce three alert tiers because of noise.”
“can confirm this team is really cool”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.