Two different layers: Socket watches your dependency graph and the public registries on an ongoing basis for 70+ risk types, dependency confusion among them. This tool reads the pip/npm configuration you already have, once, locally, for the two specific shapes that make a confusion attack possible — no account, no registry calls, nothing installed.
Socket is a supply-chain security platform. Its own site describes deep package inspection that characterizes what a dependency actually does, rather than relying only on known-vulnerability databases, connected through a GitHub app, a CLI, and a browser extension. It flags more than 70 categories of risk across npm, PyPI, and other ecosystems — dependency confusion, typosquatting, malware, hidden or obfuscated code, risky install scripts, and permission creep among them — and monitors changes to a project's dependency manifest on an ongoing basis. It is free for public, open-source use, and Socket's own site lists paid Team, Business, and Enterprise tiers for private-repository and organization use; today's specific prices and contract terms are not repeated here, since this session cannot verify them live against Socket's own site — only its well-documented product shape is described.
This tool does none of what Socket does. It has no account, no
ongoing service, no GitHub app, and no connection of any kind to a
package registry — it cannot tell you whether a name is
actually published anywhere, let alone whether it behaves
maliciously. It reads only the two specific, well-documented
configuration shapes behind the 2021 dependency-confusion incidents:
a pip --extra-index-url use, and an unscoped npm
dependency name while .npmrc sets a private default
registry. Paste the files you already have, or run the CLI against a
checkout, and get every finding with its fix — free, in your
browser or a zero-dependency script, with nothing uploaded and no
network calls of its own.
| Question | Where to answer it |
|---|---|
| I want continuous, registry-aware scanning of my whole dependency graph for malware, typosquats, and dozens of other supply-chain risks — not just dependency confusion. | Socket — that is the ongoing, cross-ecosystem job it is built for. |
I suspect a pip --extra-index-url use or an unscoped npm name in my own config might let a decoy package win, and want to check it right now, for free, without connecting anything. | This tool — paste the files, get the findings, nothing installed. |
| I want a GitHub app or CLI that watches every future pull request for newly introduced risky dependencies. | Socket — this tool has no memory between runs and does not watch anything. |
I want zero network calls and nothing to install to check a requirements.txt, package.json, and .npmrc I already have. | This tool — it never queries a registry, GitHub, or anywhere else. |
| I want to know whether a specific package name is actually published on the public registry, or has ever shown malicious behavior. | Socket — this tool makes no registry calls and cannot answer that. |
| I want a one-time, local read of the configuration shape itself, split by pattern, with the exact fix. | This tool — that is the whole job, and the only one it does. |
A team can reasonably run both: Socket for continuous, registry-aware defense against a live attack already under way, and this tool as a fast, zero-account, zero-network first pass over the two specific misconfigurations that make such an attack possible in the first place. This page does not evaluate Socket's detection accuracy and makes no claim about it either way — it only describes Socket's documented product shape and states what this tool does differently. Socket catching a live decoy package and this tool flagging a configuration shape are two different signals; neither replaces the other, and a clean result from either one is not a supply-chain security guarantee.
This tool needs no account and no sign-in: it is a static page, the check runs in your browser (or as a stdlib-only CLI script), and it keeps working with the network connection off.
Not in the way this tool does. Socket's own site describes deep package inspection and real-time monitoring across more than 70 risk categories — including dependency confusion, typosquatting, hidden code, risky install scripts, and permission creep — by watching your dependency graph against live registry data through a GitHub app, CLI, or browser extension. That is package-behavior analysis, not a read of your own requirements.txt, pip.conf, package.json, or .npmrc. This tool does the opposite and narrower thing: it never queries a registry at all, and instead reads those exact files for the two configuration shapes documented in Alex Birsan's 2021 research — a pip --extra-index-url use, and an unscoped npm dependency name behind a private .npmrc registry.
They work at different layers, and a team can reasonably run both. Socket runs on an ongoing basis against your dependency graph and the public registries, watching for a live attack — a newly published decoy package, a suspicious permission change, or dozens of other package-behavior signals — as a service that is free for public open-source use and offers paid plans for private and organization use, per Socket's own site; connecting it needs a GitHub app, CLI, or browser extension. This tool checks something Socket does not read directly: whether your own pip and npm configuration is shaped so that a confusion attack could work in the first place, entirely on your device, one time, free, no account, no network calls of its own. Socket can catch an attacker who already published a decoy; this tool tells you whether your configuration would fall for one.
No. This page is not affiliated with, endorsed by, or sponsored by Socket, Inc. Socket is a trademark of Socket, Inc., named here only to describe what this tool is and is not, based on Socket's own publicly documented product.
Open the Dependency Confusion Check to scan your own config, or read what is dependency confusion? for the full mechanism and a worked incident.