Two different layers: Socket watches your dependency graph and the public registries on an ongoing basis for 70+ risk types, typosquatting among them. This tool makes one on-demand, read-only registry request per dependency to answer one narrow question — does this exact name exist, and does it look freshly squatted — no account, no ongoing service.
Socket is a supply-chain security platform. Its own site describes deep package inspection that characterizes what a dependency actually does, rather than relying only on known-vulnerability databases, connected through a GitHub app, a CLI, and a browser extension. It flags more than 70 categories of risk across npm, PyPI, and other ecosystems — typosquatting, malware, hidden or obfuscated code, and permission creep among them — and monitors changes to a project's dependency manifest on an ongoing basis. It is free for public, open-source use, and Socket's own site lists paid Team, Business, and Enterprise tiers for private-repository and organization use; today's specific prices and contract terms are not repeated here, since this session cannot verify them live against Socket's own site — only its well-documented product shape is described.
This tool does one narrower thing, on demand rather than continuously:
given a package.json, it makes one read-only GET request
per dependency to registry.npmjs.org and reports whether
the name resolves at all, and if it does, whether it was published
very recently with almost no version history — the specific
fingerprint of a name freshly registered after being hallucinated by
an AI assistant or guessed by a typosquatter. It has no account, no
ongoing service, and no GitHub app, and it does not attempt any of
Socket's other 69-plus risk categories.
| Question | Where to answer it |
|---|---|
| I want continuous, registry-aware scanning of my whole dependency graph for malware, typosquats, permission creep, and dozens of other supply-chain risks. | Socket — that is the ongoing, cross-ecosystem job it is built for. |
| I want to know right now, for free, whether a specific dependency name actually exists and whether it looks freshly squatted. | This tool — one command, one read-only request per dependency, no account. |
| I want a GitHub app or browser extension that watches every future pull request for newly introduced risky dependencies. | Socket — this tool has no memory between runs and no ongoing monitoring. |
| I want a fully offline check with zero network calls of any kind, even at the cost of not knowing whether a name actually exists. | This tool's browser page — it flags near-misses of well-known names locally and never touches the network; the live check is CLI-only. |
| I want to know whether a specific package has ever shown malicious behavior at runtime. | Socket — this tool only checks a name's existence and registration recency, never behavior. |
A team can reasonably run both: Socket for continuous, registry-aware defense across many risk types, and this tool as a fast, zero-account gate specifically for the AI-hallucination pattern — in CI, at release time, or by hand. This page does not evaluate Socket's detection accuracy and makes no claim about it either way — it only describes Socket's documented product shape and states what this tool does differently. Socket catching a live malicious package and this tool flagging a freshly squatted name are two different signals; neither replaces the other, and a clean result from either one is not a supply-chain security guarantee.
This tool needs no account and no sign-in. The browser page is a static page with no network call of any kind; the CLI is a single stdlib-only script that makes one read-only registry request per dependency.
Socket's own site describes deep package inspection and real-time monitoring across more than 70 risk categories, typosquatting among them, by watching your dependency graph against live registry data through a GitHub app, CLI, or browser extension. That is ongoing, registry-aware monitoring across many risk types at once. This tool does one narrower, on-demand thing: for each dependency in a package.json you hand it, it makes one read-only request to the public npm registry and reports whether the name exists at all, and if it does, whether it was published suspiciously recently with almost no version history.
They work at different layers, and a team can reasonably run both. Socket runs on an ongoing basis against your dependency graph and the public registries, watching for a live attack across dozens of package-behavior signals, as a service that is free for public open-source use and offers paid plans for private and organization use, per Socket's own site; connecting it needs a GitHub app, CLI, or browser extension. This tool answers one narrower question, on demand, with nothing to connect: does this exact name exist, and does it look freshly squatted? Free, no account, one read-only request per dependency.
No. This page is not affiliated with, endorsed by, or sponsored by Socket, Inc. Socket is a trademark of Socket, Inc., named here only to describe what this tool is and is not, based on Socket's own publicly documented product.
Open Slopsquatting Check to scan your own package.json, or read what slopsquatting is and why a lockfile doesn't already protect you for the full mechanism.