Aevral
[Supply-chain security]

Socket and Aevral, at a glance

Socket analyzes packages and dependency changes for supply-chain risk, like install scripts, obfuscation, and privileged API use, across the dependency tree.

Socket guards the packages: it analyzes packages and dependency changes for supply-chain risk, like install scripts, obfuscation, and privileged API use, so a suspicious package surfaces before it lands. Aevral guards the access rules: it reads your own code, the repository snapshot, for authorization, IDOR, and business-logic access control. The dependency tree and the access rules are two different surfaces, and the two tools address each on its own published terms.

Socket focuses on

  • Analyzing packages and dependency changes for supply-chain risk.
  • Surfacing install scripts, obfuscation, and privileged API use.
  • Covering the dependency tree.

Aevral adds alongside

  • The reading of what your own code grants: over-scoped tokens, widened gates, caller-controlled references.
  • The same reading on every pull request, as an opt-in add-on.
  • A fix prompt you hand to the coding agent you already use, with a human reviewing before merge.

Run them together

Let Socket analyze the dependency tree; let Aevral read what your own code grants.

Socket and Aevral, in depth; Aevral whole-repo scan.

Also alongside

Scan your whole repo for access bugs.

One GitHub App. A report with evidence. A prompt for the agent you already use.

Join waitlist