Socket

Socket is a developer-first security company that protects applications from software supply chain attacks originating in open source dependencies. Its platform monitors package registries in real time and uses AI-assisted code analysis to detect malware, backdoors, obfuscated code, and data-exfiltration behavior in npm, PyPI, and Go packages, often within minutes of publication. It also flags known vulnerabilities and open source license compliance issues inside existing developer workflows such as pull requests. The company was founded in 2020 by open source maintainer and former Stanford web security lecturer Feross Aboukhadijeh, and has raised roughly $125M across seed, Series A, and Series B rounds from investors including Andreessen Horowitz, Abstract Ventures, Elad Gil, and Thrive Capital.

Rather than only matching dependencies against a known-vulnerability database, Socket inspects package behavior to catch actively malicious and zero-day supply chain attacks — the company reports detecting over 100 such attacks per week — while keeping false positives low enough for engineers to leave it enabled in their day-to-day workflow.