Socket proactively blocks malicious open source packages in your code.
InstallSecure your dependencies with us
Today we're announcing Socket's $60 million Series C at a $1 billion valuation, led by Thrive Capital, with participation from Andreessen Horowitz, Abstract Ventures, and Capital One Ventures. The round brings our total funding to $125 million and sets up the next phase of what we're building to protect the software supply chain.
This is the moment we've been working toward since we started Socket. AI has changed how every engineering team writes and ships code, increasing the volume of open source entering production. At the same time, attackers have spent the past several years exploiting a trust gap in open source that the industry was slow to defend.
When we first announced Socket four years ago, modern applications were already pulling in more open source code than any team could realistically review. The dominant approach to securing dependencies was to scan for known vulnerabilities after public disclosure, which left a long gap between the moment a malicious package hit a public registry and the moment defenders had any chance to act on it. We believed that gap was where the next generation of attacks would happen, and that the right response was to analyze the actual behavior of dependencies in real time.
That conviction has only sharpened. AI now writes more than 90% of code at top engineering organizations and a substantial share everywhere else. A lot of what AI produces reaches for open source dependencies developers have never read. The volume of third-party code entering production keeps going up, the time anyone spends reviewing it keeps going down, and security tools from the previous era can't keep up.
Supply chain attacks in the past year have been relentless. The Shai-Hulud worm has hit npm in repeated waves since September 2025, most recently as Mini Shai-Hulud across npm, PyPI, and Packagist earlier this month. Attackers compromised Aqua Security's Trivy scanner in March and used the stolen credentials for a chain of follow-on attacks. DPRK-aligned attackers ran a social engineering campaign against Node.js maintainers, including several Socket engineers, and the same playbook compromised Axios.
Package hijackings and maintainer compromises that were once a handful of incidents a year now happen weekly. They're the new normal. Attackers caught on to a trust gap that has existed for decades, and the industry was slow to build defenses for behavioral risk in open source because we all assumed Linus' Law would hold. The disclosure process most defenders rely on can't catch what the security community hasn't catalogued.
Since we closed our Series B in October 2024, Socket has grown from 7,500 organizations to more than 27,000. We protect 1.5 million repositories and secure over 11.6 million commits every month. Our platform blocks more than 10,000 supply chain attacks every week. The team has grown to more than 100 people.
The companies building the most ambitious AI products run Socket. Anthropic, xAI, Replit, Cursor, Vercel, Figma, Gusto, Mercado Libre, and Cribl are customers, alongside Fortune 100 companies in financial services and global media. These teams are shipping faster than ever, and they need security that moves at the same speed.
We've shipped a lot of product since the last round. Socket Firewall blocks malicious packages at install time, stopping compromised dependencies before they ever reach a developer's laptop or a CI pipeline. With our acquisition of Coana, we brought reachability analysis into the platform for precision CVE triage, which eliminates 50 to 80 percent of irrelevant vulnerability alerts by focusing only on the vulnerabilities that are actually exploitable. Socket Certified Patches let teams remediate exploitable CVEs in seconds without waiting on upstream maintainers.
When the Axios compromise hit, our detection systems flagged the malicious dependency within six minutes. Within 24 hours, more than 2,000 organizations had onboarded to Socket to block the package from reaching their environments. That speed of response is the entire point of what we've built.
Thrive Capital led the round because they see the same shift. Philip Clark, Partner at Thrive Capital, on why the legacy approach no longer works: "Legacy tools were designed to react to known vulnerabilities and assumed there was sufficient time to prevent a breach. Today, AI models can identify vulnerabilities so well and so quickly that this is no longer an option."
With this round, we're focused on five areas.
Investing in Socket Firewall. Firewall already blocks malicious packages before they reach a developer's environment or CI pipeline. Socket Firewall is free for everyone, part of how we help defend the open source ecosystem. We're going to make it faster and sharper across more ecosystems, with new detections, better policy controls, and deeper integration into the places developers and agents install code.
Massively expanding Socket Certified Patches. Certified Patches are surgical fixes that let teams remediate exploitable CVEs without breaking production. We validate each patch against hundreds of AI-created test cases, giving teams an instant way to protect applications while they define a safe upgrade path. We're scaling the catalog to help defenders respond faster to the growing volume of disclosures as AI accelerates vulnerability discovery.
Moving protection closer to the point of install. Following our acquisition of Secure Annex, Socket is extending coverage from package managers to browser extensions, code editor extensions, MCP servers, and AI tools. Attackers are moving across packages, extensions, containers, CI/CD, and AI-adjacent tooling in rapid succession, and Socket needs to defend that whole surface.
Imminent product launches. New products coming soon push Socket into a category we haven't entered before. It's the natural next step for what we've been building.
Growing the team. Socket has gotten this far with a small, technically deep team. We're going to keep that bar high as we grow.
Alongside this round, we're rolling out a refreshed Socket brand, starting with a redesigned homepage and a refinement of our logo. The rest of the site will follow over the coming days. It's a sharper evolution of the same Socket.
This is a historic moment for software. AI is reshaping the industry faster than any technology in a generation, and the work of securing it has never mattered more. We're hiring across engineering, sales, customer success, and threat intel. If you want to work on the hardest problems in this space with a team that ships fast and takes the open source community seriously, take a look at our open roles at socket.dev/careers.
To every maintainer and developer working in open source: we see what you're up against, we're with you, and we're going to keep working to defend it. To our customers, our investors, and the team that has shipped all of this: thank you. There's a lot more to build.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。