Socket Scores and Alerts

Socket scores and alerts are broken down into the following categories:

• Supply chain risk
• Quality
• Maintenance
• Vulnerabilities
• License

Socket scores packages across several categories, with alert severity playing a major role. Each type of alert (Critical, High, Medium, or Low) affects the score differently through normalization functions and soft caps. The final score is raised to the power of γ, a scaling factor based on the size and popularity of the project. This exponent compresses low scores and softens the impact of penalties, especially for large or popular packages. Each metric may also optionally apply a limit.

Critical Alerts:
When any critical alerts are present, this metric is limited to the minimum of 0.25 and a weighted average of other scoring signals. The limit of 0.25 acts as a soft cap because the final score is calculated as 100 × (min(limit, weighted-average))^γ. For example, when γ = 0.8, a cap of 0.25 leads to a final score of about 33%. However, if the weighted average is lower than 0.25, the final score can fall even further.

High Alerts:
High alerts reduce the score using an exponential decay, e^−x. The metric is capped at max(0.25, 1 − x/10), bottoming out at 0.25 when there are 8 or more alerts. The actual contribution can go lower due to weighted averaging. If this metric becomes the lowest among all, it can pull down the overall score significantly.

Medium Alerts:
Medium alerts decay more slowly using e^−x/20, with a cap of max(0.5, 1.15 − x/20), which levels off at 0.5 after about 13 alerts. Even though the limit flattens, the normalized value can fall below 0.5 and continue decreasing.

Low Alerts:
Low alerts have the least impact. They decay gently with e^−x/40 and have no cap, so their effect on the score remains small and gradual. Other Factors:

Package scores are also influenced by project attributes like popularity, size, and maintenance activity. These affect the γ exponent. Larger or more widely used packages tend to have a smaller γ, which reduces the impact of negative metrics and allows those packages to maintain relatively higher scores even when some alerts are present.

Breakdown:

Given a category i, let x_i,j be the value of metric j with normalization function N_j and weight w_j and limit l_i,j.

Then the score S_i is

S_i = 100 · min ( max (0, min_j l_i,j), ^{∑_j w_j N_j(x_j)}/_{∑j wj} )^γ

Where γ is a power scaling constant based on the size and popularity of the project:

γ ≈ ¹/₂ + c₀ log(lines of code) + c₁ log(popularity)

Currently socket supports the following metrics:

Please note that these metrics are subject to change and may be revised as we make changes to our system. The contents of this document may not exactly represent the scoring system as deployed in Socket at this point in time as we are continuously making adjustments to these systems.