JavaScript and TypeScript

This guide covers Full Application Reachability (previously Tier 1) via the --reach flag. For an overview of all reachability types, see the Reachability Analysis overview.

Socket supports Full Application Reachability for the following JavaScript and TypeScript package managers:

• npm
• pnpm
• Yarn
• Bun
• vlt

Prerequisites

Install Socket CLI:

npm install -g socket
socket login

Or set API key:

export SOCKET_SECURITY_API_TOKEN=sktsec_<your_key>

Note: socket scan create requires an org slug. Run socket login to set a default, or pass --org <your-org-slug> on every command.

Note: JavaScript and TypeScript are dynamically typed, so reachability analysis is more resource-intensive than statically typed languages. Ensure at least 16 GB RAM is available.

npm

Step 1: Ensure Lockfile Exists

Ensure package-lock.json is committed to source control:

npm install
git add package-lock.json

Socket reads these manifest files directly:

• package.json
• package-lock.json

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

Socket constructs a cross-dependency call graph from source code to determine which CVEs are exploitable. The project does not need to be built first.

Note: If dependencies are not preinstalled (node_modules), the CLI installs them itself and prints an info message after the results: "Dependencies are not preinstalled. This can result in CVEs with unknown reachability if you use private dependencies", followed by the affected projects. Run npm install before the scan for best results.

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

pnpm

Step 1: Ensure Lockfile Exists

Ensure pnpm-lock.yaml is committed to source control:

pnpm install
git add pnpm-lock.yaml

Socket reads these manifest files directly:

• package.json
• pnpm-lock.yaml

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

Note: If dependencies are not preinstalled (node_modules), the CLI will warn about unknown reachability for private dependencies. Run pnpm install before the scan for best results.

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

Yarn

Step 1: Ensure Lockfile Exists

Ensure yarn.lock is committed to source control:

yarn install
git add yarn.lock

Socket reads these manifest files directly:

• package.json
• yarn.lock

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

Note: If dependencies are not preinstalled (node_modules), the CLI will warn about unknown reachability for private dependencies. Run yarn install before the scan for best results.

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

Bun

Step 1: Ensure Lockfile Exists

Ensure bun.lock is committed to source control:

bun install
git add bun.lock

Socket reads these manifest files directly:

• package.json
• bun.lock

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

Note: If dependencies are not preinstalled (node_modules), the CLI will warn about unknown reachability for private dependencies. Run bun install before the scan for best results.

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

vlt

Step 1: Ensure Lockfile Exists

Ensure vlt-lock.json is committed to source control. vlt has no default registry, so configure one first if you haven't already (or run vlt setup):

vlt config set registries.npm=https://registry.npmjs.org/
vlt install
git add vlt-lock.json

Socket reads these manifest files directly:

• package.json
• vlt-lock.json

Step 2: Run Baseline Scan

socket scan create .

Note the total CVE count.

Step 3: Run Reachability Scan

socket scan create --reach .

To run reachability analysis locally without uploading results:

socket scan reach

Results are saved to .socket.facts.json.

Note: Delete .socket.facts.json before running socket scan create without --reach. Otherwise it is uploaded as an SBOM carrying stale reachability results.

Performance Tuning

socket scan create --reach \
  --reach-analysis-timeout 20m \
  --reach-analysis-memory-limit 32GB \
  --reach-concurrency 4 \
  .

Interpreting Results

View scan results in Socket Dashboard and filter by reachability status.

The CLI outputs a summary table per ecosystem:

Project                 │ Vulns │ Reach │ Unreach │ NoSup │ NoReach │ Skipped │ Error │ Noise% │ Time

Calculate noise reduction manually:

Noise% = ((Unreachable + NoSup + NoReach) / Total Vulns) × 100

Result Categories

In the Dashboard, additional statuses appear: Potentially Reachable (precomputed reachability indirect chain), Pending Precomputation (precomputed reachability processing), Not Determinable, and Unknown.

Triage Reachable CVEs

Review CVEs marked as "Reachable" in Dashboard. For each:

• Check severity and CVSS score
• Evaluate upgrade path
• Prioritize remediation

Override Unreachable CVEs (Optional)

For unreachable CVEs with low business impact, click Override in Dashboard to suppress from future scans.