Supply-chain security

Socket and Aevral, at a glance

Socket analyzes packages and dependency changes for supply-chain risk, like install scripts, obfuscation, and privileged API use, across the dependency tree.

Socket guards the packages: it analyzes packages and dependency changes for supply-chain risk, like install scripts, obfuscation, and privileged API use, so a suspicious package surfaces before it lands. Aevral guards the access rules: it reads your own code, the repository snapshot, for access control and business logic. The dependency tree and the access rules are two different surfaces, and the two tools address each on its own published terms.

Socket focuses on

Analyzing packages and dependency changes for supply-chain risk.
Surfacing install scripts, obfuscation, and privileged API use.
Covering the dependency tree.

Aevral adds alongside

The reading of what your own code grants: over-scoped tokens, widened gates, caller-controlled references.
A wider security reading on pull requests, live on install.
A fix prompt you hand to the coding agent you already use, with a human reviewing before merge.

Run them together

Let Socket analyze the dependency tree; let Aevral read what your own code grants.

Socket and Aevral, in depth; Aevral whole-repo scan.

Also alongside

Security review, handled.

Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.

Install the GitHub App Log in Sign up

For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.