Malicious packagesOpen client, hosted service

Socket CLI

Client for Socket, which analyzes what each package version does to spot malware and risky behaviour.

Stars: ★ 323
License: MIT
Language: TypeScript
Latest release: v1.1.146
Last push: 10 Oct 2026
OpenSSF Scorecard: Not in the weekly scan

ghtier rating4/5 · Recommended

Catches malicious packages before they have a CVE, but the analysis runs in Socket's service and needs an API key.

How it works

Socket analyzes every version published to npm, PyPI and other registries: install scripts, network and shell access, filesystem and environment variable access, obfuscated code, typosquatted names and maintainer changes, plus AI-assisted malware review. It does this when a version is published, so verdicts are ready before you install.

The CLI uploads your manifests and lockfiles (socket scan create) and reports alerts against your organization's policy. socket npm wraps npm install and checks packages before they install. The GitHub app comments on pull requests that add risky dependencies.

What it catches

Known malware and newly published malicious versions
Install scripts, network calls and obfuscation in new dependencies
Typosquats of popular packages
Unexpected new maintainers or protestware

Run it

npm install -g socket
socket login
socket scan create --repo my-repo .

What leaves your machine

Manifest and lockfile contents (package names and versions) go to Socket's API. Source code is not uploaded.

Limits

Needs a Socket account and API token; fork PRs don't get the secret, so make the step skip cleanly.
Verdicts come from Socket's service, so you can't reproduce them offline.

Related tools

OSV-Scanner★ 11k npm audit★ 10k

Related incidents

OrganizationSeptember 2025 / November 2025 / May 2026

Shai-Hulud self-propagating worm (1.0 & 2.0)

The worm made GitHub permissions the propagation mechanism. It validated available GitHub tokens and their permissions, then queried /user/repos?affiliation=owner,collaborator,organization_member to find repos where the compromised account had enough privilege. It planted shai-hulud-workflow.yml, exfiltrated ${{ toJSON(secrets) }} to a webhook, and made repos public, including any the victim merely held tokens for. The 2.0 variant registered the infected host as a self-hosted Actions runner named SHA1HULUD and planted an injection-prone workflow at .github/workflows/discussion.yaml, so opening a GitHub Discussion gave arbitrary command execution on the host. 2.0 compromised 796 npm packages, with credential exfiltration confirmed across more than 500 GitHub users spanning 150+ organizations. A smaller descendant, known as Mini Shai-Hulud, hit in May 2026: on 19 May one developer account takeover led to more than 630 malicious versions across 317 npm packages in about 20 minutes, including AntV packages. The TanStack compromise a week earlier came through a different door, Actions cache poisoning (see the cache poisoning incident).

Click to open →

OrganizationAugust 2025

Nx "s1ngularity"

The injected script extracted a read/write GitHub token, a consequence of the workflow permissions setting, then created a branch replacing the CI script, triggered the publish workflow against that branch via the API using workflow_dispatch, and deleted branches and workflow runs to clean up. When publish ran, it had NPM_TOKEN in scope and exfiltrated it. The PR targeted an outdated branch that still carried the vulnerable workflow after it had been reverted on master. In phase two, the stolen GitHub tokens were used to flip thousands of private repositories to public. Downstream, one threat-intel group rode the consequences to full AWS administrator access at a victim org in under 72 hours, via OIDC trust chains and a CloudFormation IAM capability chain. No zero-days were involved.