Catch risky dependencies in pull requests

On every pull request that changes a manifest, Socket compares the new dependencies with the base branch and reports only what changed. Your policy's action for each alert decides what developers see:

A failing check stops a merge only when branch protection requires it. That's set up in Tune policy and enforce.

Before you start: the app is installed on socket-poc-sandbox (Connect your repositories).

1. Open a pull request with a malicious dependency

[email protected] is a security holding package that Socket flags as known malware, and the Default policy blocks known malware. It is only declared in package.json, never installed, so nothing runs.

git clone https://github.com/your-github-org/socket-poc-sandbox
cd socket-poc-sandbox
git checkout -b socket-pr-test

cat > package.json <<'JSON'
{ "name": "socket-poc-test", "version": "1.0.0", "dependencies": { "lodahs": "0.0.1-security" } }
JSON

git add package.json
git commit -m "test: malicious dependency for Socket"
git push -u origin socket-pr-test

Open a pull request from socket-pr-test into main. Note the time you pushed.

2. Check the result

Silent mode on: nothing appears on GitHub. In the dashboard, the pull request's scan shows a Known malware alert on lodahs. This proves detection with no developer impact.

Silent mode off: within about a minute the pull request gets a Socket comment naming lodahs, and the Socket Security: Pull Request Alerts check fails.

3. Remove it and watch it clear

cat > package.json <<'JSON'
{ "name": "socket-poc-test", "version": "1.0.0", "dependencies": {} }
JSON

git commit -am "test: remove malicious dependency"
git push

The new scan has no alert, and with silent mode off the check passes.

Verify

• The pull request scan shows Known malware on [email protected]
• With silent mode off, the comment appears and the check fails
• After the dependency is removed, the alert clears and the check passes
• A commit that changes no manifest triggers no new comment

What good looks like

Agree the bar at kickoff. Bars teams commonly set:

Troubleshooting

Reference

• Guide to Socket for GitHub
• Policies: where policies apply
• Sample Test Packages