Socket.dev

Supply chain malware detection

Free tier + paidCode review, testing & securitysocket.dev

What it is

Inspects what a package actually does rather than only matching published CVEs, detecting 70+ risk types including install scripts, unexpected network or filesystem access, obfuscated code, typosquats and outright malware. It comments on the pull request when a dependency change introduces new capabilities. Higher tiers add reachability analysis to cut CVE noise.

Why it earns a slot

This is the direct answer to AI package hallucination and slopsquatting. When your agent adds a convincing-sounding package published last week that phones home on install, Socket blocks the pull request.

Know before you commit

Team carries a 5-developer minimum, a $125/mo floor, and Business a 20-developer minimum, so small teams pay for seats that do not exist.

Getting started

Install the Socket GitHub App for PR comments, or run npx socket in CI

Field notes

0 from the community

Loading notes…

Field check

Unverified

Pricing snapshot

Free $0: 1,000 scans/mo, 3 members, 1 repository label; Team $25/dev/mo with a 5-developer minimum; Business $50/dev/mo with a 20-developer minimum; Enterprise custom; free Team accounts for open source on request

Snapshots move fast — verify at checkout, and post a field note if it changed.

Drop into your Lovable chat

Evaluate Socket.dev (https://socket.dev) for this project, then use it only if it fits what we are already building.
Context: Supply chain malware detection. Inspects what a package actually does rather than only matching published CVEs, detecting 70+ risk types including install scripts, unexpected network or filesystem access, obfuscated code, typosquats and outright malware. It comments on the pull request when a dependency change introduces new capabilities. Higher tiers add reachability analysis to cut CVE noise.
Reviewer notes (general, not written for this codebase): This is the direct answer to AI package hallucination and slopsquatting. When your agent adds a convincing-sounding package published last week that phones home on install, Socket blocks the pull request.
Watch out for: Team carries a 5-developer minimum, a $125/mo floor, and Business a 20-developer minimum, so small teams pay for seats that do not exist.
Pricing: Free $0: 1,000 scans/mo, 3 members, 1 repository label; Team $25/dev/mo with a 5-developer minimum; Business $50/dev/mo with a 20-developer minimum; Enterprise custom; free Team accounts for open source on request
Setup: Install the Socket GitHub App for PR comments, or run npx socket in CI
Rules: treat the notes above as background only. Do not assume a theme, style, layout or feature that is not already in this project — inspect the existing code first and ask me before changing visual direction.

/api/public/tools/socket-dev

Neighbourhood

How Socket.dev sits against the rest of the atlas — swaps, companions and the tools builders actually save alongside it.

Instead of thisDependabot Gitleaks Playwright Stagehand Storybook test runner Testing Library Trivy Vitest Aikido Security Arcjet

Also in Code review, testing & security

Aikido Security

aikido.dev

All-in-one AppSec scanner

Free tier + paidCode review, testing & security

Developer free forever: 2 users, 10 repos, 2 container images, 1 domain, 250k protected requests/mo, 10 AI autofixes/mo; Basic $300/mo base for 10 users and 100 repos; Pro $600/mo for 200 repos; Advanced $600/mo for 500 repos; Enterprise custom

Open dossier

Arcjet

arcjet.com

In-app rate limiting and bot defence

PaidCode review, testing & security

No free plan as of 2026; Individual $25/app/mo; Startup $299/app/mo; Growth $799/app/mo; usage fees on top at $5 per 1M requests plus per-feature rates such as $0.50 per 1M for bot detection; 15-day trial

Open dossier

Bito

bito.ai

AI PR review agent

PaidCode review, testing & security

Team $12/seat/mo annually or $15 monthly; Professional $20/seat/mo annually or $25 monthly; both include 5,000 lines reviewed per seat per month, overage $5 per 1,000 lines; Enterprise custom; 14-day trial

Open dossier

Browserbase

browserbase.com

Hosted headless browser cloud

Free tier + paidCode review, testing & security

Free: 1 browser hour/mo; Developer $20/mo with 100 browser hours then $0.12/hr; Startup $99/mo with 500 hours then $0.10/hr; Scale custom with 250+ concurrent browsers

Open dossier