Package Health Score

76 / 100

security
Security review needed
popularity
Limited
maintenance
Healthy
community
Active

Explore Similar Packages

Security

Security review needed

All security vulnerabilities belong to production dependencies of direct and indirect packages.

Security and license risk for significant versions

Version			Vulnerabilities	License Risk
0.14.38	\|	12/2024	0 C 0 H 0 M 0 L	0 H 0 M 0 L
0.14.35	\|	12/2024	0 C 0 H 0 M 0 L	0 H 0 M 0 L
0.0.1	\|	07/2012	0 C 0 H 0 M 0 L	0 H 0 M 0 L

License

MIT

Security Policy

Is your project affected by vulnerabilities?

Scan your projects for vulnerabilities. Fix quickly with automated fixes. Get started with Snyk for free.

Get started free

Popularity

Limited

Weekly Downloads (762)

GitHub Stars: 113
Forks: 15
Contributors: 20

Direct Usage Popularity

The npm package socket receives a total of 762 downloads a week. As such, we scored socket popularity level to be Limited.

Based on project statistics from the GitHub repository for the npm package socket, we found that it has been starred 113 times.

Downloads are calculated as moving averages for a period of the last 12 months, excluding weekends and known missing data points.

Community

Active

Readme.md: Yes
Contributing.md: No
Code of Conduct: Yes
Contributors: 20
Funding: No

With more than 10 contributors for the socket repository, this is possibly a sign for a growing and inviting community.

Embed Package Health Score Badge

Maintenance

Healthy

Commit Frequency

Open Issues: 4
Open PR: 1
Last Release: 10 hours ago
Last Commit: 4 days ago

Further analysis of the maintenance status of socket based on released npm versions cadence, the repository activity, and other data points determined that its maintenance is Healthy.

We found that socket demonstrates a positive version release cadence with at least one new version released in the past 3 months.

As a healthy sign for on-going project maintenance, we found that the GitHub repository had at least 1 pull request or issue interacted with by the community.

Keep your project healthy

Check your package.json

Ensure all the packages you're using are healthy and well-maintained

Snyk Vulnerability Scanner

Get health score & security insights directly in your IDE

Package

Node.js Compatibility: ^18.20.4 || ^20.9.0 || >=22.0.0

Age: 12 years
Dependencies: 32 Direct
Versions: 30
Install Size: 770 kB
Dist-tags: 1
# of Files: 34
Maintainers: 2
TS Typings: No

socket has more than a single and default latest tag published for the npm package. This means, there may be other tags available for this package, such as next to indicate future releases, or stable to indicate stable releases.

Not sure how to use socket?

To help you get started, we've collected the most common ways that socket is being used within popular public projects.

mockstarjs / mockstar / packages / mockstar-client / src / model / SocketClient.js View on Github

constructor(url) {
        this.url = url || 'http://local.mockstarjs.org';

        this.socket = io(this.url);

        // 序列号，用于识别不同的事件
        this._seq = 0;

        this.init();
    }

View more ways to use socket

Socket CLI

> CLI tool for Socket.dev

Usage

npm install -g socket

socket --help
socket info webtorrent@1.9.1
socket report create package.json --view
socket report view QXU8PmK7LfH608RAwfIKdbcHgwEd_ZeWJ9QEGv05FJUQ
socket wrapper --enable

Commands

Popular Commands

socket npm [args...] and socket npx [args...] - Wraps npm and npx to integrate Socket and preempt installation of alerted packages using the builtin resolution of npm to precisely determine package installations.
socket optimize - Optimize dependencies with @socketregistry overrides! (👀 our blog post)
- --pin - Pin overrides to their latest version.
- --prod - Add overrides for only production dependencies.

Other Commands

socket cdxgen [command] - Call out to cdxgen. See their documentation for commands.
socket info - Look up issues for a package.
socket raw-npm [args...] and socket raw-npx [args...] - Temporarily disable the Socket 'safe-npm' wrapper.
socket report create - Create a report on Socket.dev

Upload the specified package.json and lock files for JavaScript, Python, and Go dependency manifests. If any folder is specified, the ones found in there recursively are uploaded.

Glob patterns such as **/package.json, **/requirements.txt, **/pyproject.toml, and **/go.mod is supported.

Intuitively ignores files matching your project's .gitignore, the projectIgnorePaths in your project's socket.yml, and a sensible set of default ignore patterns.
socket report view - Look up issues and scores from a report.
socket wrapper --enable and socket wrapper --disable - Enable and disable the Socket 'safe-npm' wrapper.

Aliases

All aliases support the flags and arguments of the commands they alias.

socket ci - alias for socket report create --view --strict which creates a report and quits with an exit code if the result is unhealthy. Use like eg. socket ci . for a report for the current folder

Flags

Command specific flags

--view - when set on socket report create the command will immediately do a socket report view style view of the created report, waiting for the server to complete it

Output flags

--json - outputs result as json which you can then pipe into jq and other tools
--markdown - outputs result as markdown which you can then copy into an issue, PR or even chat

Strictness flags

--all - by default only high and critical issues are included, by setting this flag all issues will be included
--strict - when set, exits with an error code if report result is deemed unhealthy

Other flags

--dry-run - like all CLI tools that perform an action should have, we have a dry run flag. Eg. socket report create supports running the command without actually uploading anything
--debug - outputs additional debug output. Great for debugging, geeks and us who develop. Hopefully you will never need it, but it can still be fun, right?
--help - prints the help for the current command. All CLI tools should have this flag
--version - prints the version of the tool. All CLI tools should have this flag

Configuration files

The CLI reads and uses data from a socket.yml file in the folder you run it in. It supports the version 2 of the socket.yml file format and makes use of the projectIgnorePaths to excludes files when creating a report.

Environment variables

SOCKET_SECURITY_API_KEY - if set, this will be used as the API-key

Contributing

Environment variables for development

SOCKET_SECURITY_API_BASE_URL - if set, this will be the base for all API-calls. Defaults to https://api.socket.dev/v0/
SOCKET_SECURITY_API_PROXY - if set to something like https://127.0.0.1:9090, then all request will be proxied through that proxy

Similar projects

@socketsecurity/sdk - the SDK used in this CLI

socket development dependencies

@babel/core @babel/plugin-proposal-export-default-from @babel/plugin-syntax-dynamic-import @babel/plugin-transform-export-namespace-from @babel/plugin-transform-runtime @babel/preset-env @babel/preset-typescript @babel/runtime @eslint/compat @eslint/js @rollup/plugin-commonjs @rollup/plugin-json @rollup/plugin-node-resolve @rollup/plugin-replace @rollup/pluginutils @tapjs/run @types/blessed @types/cmd-shim @types/micromatch @types/mocha @types/mock-fs @types/node @types/npmcli__arborist @types/npmcli__promise-spawn @types/proc-log @types/semver @types/update-notifier @types/which @types/yargs-parser @typescript-eslint/eslint-plugin @typescript-eslint/parser c8 custompatch eslint eslint-import-resolver-oxc eslint-plugin-depend eslint-plugin-import-x eslint-plugin-n eslint-plugin-sort-destructure-keys eslint-plugin-unicorn husky knip magic-string mock-fs nock npm-run-all2 oxlint prettier read-package-up rollup rollup-plugin-ts type-coverage typescript typescript-eslint unplugin-purge-polyfills

FAQs

What is socket?

CLI tool for Socket.dev. Visit Snyk Advisor to see a full health score report for socket, including popularity, security, maintenance & community analysis.

Is socket popular?

The npm package socket receives a total of 762 weekly downloads. As such, socket popularity was classified as limited. Visit the popularity section on Snyk Advisor to see the full health analysis.

Is socket well maintained?

We found that socket demonstrated a healthy version release cadence and project activity. It has a community of 20 open source contributors collaborating on the project. See the full package health analysis to learn more about the package maintenance status.

Is socket safe to use?

While scanning the latest version of socket, we found that a security review is needed. A total of 0 vulnerabilities or license issues were detected. See the full security scan results.

Last updated on 30 December-2024, at 18:24 (UTC).

Build a secure application checklist

Select a recommended open source package

Minimize your risk by selecting secure & well maintained open source packages

DONE

Scan your app for vulnerabilities

Scan your application to find vulnerabilities in your: source code, open source dependencies, containers and configuration files

SCAN NOW

Fix identified vulnerabilities

Easily fix your code by leveraging automatically generated PRs

AUTO FIX

Monitor for new issues

New vulnerabilities are discovered every day. Get notified if your application is affected

MONITOR APP