socket

library1.1.86jsnpmunverified

CLI tool for Socket.dev security analysis of npm dependencies. Current stable version is 1.1.86, with a history of active releases (multiple releases in 2025). Provides commands for scanning, fixing CVEs, optimizing dependencies, and managing security patches. Key differentiators: wraps npm/npx for real-time security scanning, supports SBOM generation via cdxgen, offers automated CVE fixing and dependency optimization via @socketregistry overrides. ESM-only, requires Node.js >=18.20.8 and pnpm >=10.33.0.

devops http-networking serialization

npm install socket

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SOCKET

socket

devopsjavascriptv1.1.86

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import socket from 'socket'

✗ const socket = require('socket')

Package is ESM-only; CommonJS require() fails with ERR_REQUIRE_ESM.

run

✓ import { run } from 'socket'

The run function is the programmatic entry point. Typed as Function.

types

✓ import type { Config } from 'socket'

TypeScript types are bundled. Use import type for types if not bundling.

Demonstrates programmatic usage of socket CLI with environment variable configuration and dry-run mode.

import { run } from 'socket'; const argv = ['npm', 'install', 'express']; const config = { apiToken: process.env.SOCKET_CLI_API_TOKEN ?? '', orgSlug: process.env.SOCKET_CLI_ORG_SLUG ?? '', dryRun: true, debug: false, }; try { await run(argv, config); } catch (err) { console.error('Socket scan failed:', err); process.exit(1); }

socket --version

Debug

Known issues

gotchaPackage is ESM-only. Using require() throws ERR_REQUIRE_ESM.

fix

Use import or dynamic import() instead of require().

affects: >=0.14.39

breakingNode.js <18.20.8 is not supported. Starting from version 0.14.40, socket CLI requires Node >=18.20.8.

fix

Upgrade Node.js to >=18.20.8 or use an older version of socket CLI.

affects: >=0.14.40

gotchaThe 'socket npm' and 'socket npx' commands may interfere with your existing npm/npx workflows if not configured correctly.

fix

Use --dry-run to preview changes before actually running commands.

affects: >=0.14.0

deprecatedThe 'socket optimize' command relies on @socketregistry overrides which may be deprecated in future versions.

fix

Check release notes for replacement tools or migration guides.

affects: <0.15.0

Errors

Common errors & fixes

Error: Cannot find module 'tiny-colors'

Regression in Node 22+ where ESM packages moved to dependencies field incorrectly.

fix

Update to socket@0.14.39 or later which replaces 'tiny-colors' with 'yoctocolors-cjs'.

Error [ERR_REQUIRE_ESM]: require() of ES Module /path/to/socket/index.js not supported.

The socket package is ESM-only. Calling require('socket') fails.

fix

Change to import('socket') or use dynamic import.

TypeError: URL.parse is not a function

Node 18 does not support URL.parse; regression in socket v0.14.67.

fix

Upgrade Node to >=18.20.8 or downgrade socket to v0.14.65.

Upgrade

Version history

1.1.86latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

12 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/SocketDev/socket-cli ↗

packagehttps://www.npmjs.com/package/socket ↗

homepagehttps://socket.dev ↗