Socket just moved its PHP and Composer support out of experimental access and into public beta for every customer. PHP reachability analysis is now generally available too.

Socket is a supply chain security service that scans the open source packages an application pulls in. An audit tool checks installed versions against known advisories and stops there. It also looks for malicious code, risky install scripts, and package behavior that doesn't match what the package says it does.

Malware on Packagist

The case for that second kind of scanning is in Socket's own threat research. In April the Mini Shai-Hulud campaign jumped from npm to Packagist through a malicious version of Intercom's PHP package, abusing Composer plugin execution to steal cloud and CI/CD credentials. Other finds include packages posing as Laravel utilities that shipped an encrypted remote access trojan, and a legitimate Laravel package whose development branch was poisoned with a loader that pulled remote code off blockchain infrastructure.

As the announcement puts it:

PHP security requires more than matching package versions against known CVEs.

Scanning Composer Projects

The scanner reads composer.lock and composer.json to build the dependency tree, so a project without a lockfile still gets scanned. The beta covers:

  • SBOM generation, with or without a lockfile
  • Direct and transitive dependency analysis
  • CVE detection across Packagist packages
  • AI analysis for malicious and suspicious package behavior

Reachability Analysis

Knowing a vulnerable package is installed doesn't tell you whether your code can actually call the affected function. That's what reachability answers, and there are two versions of it for PHP.

Precomputed reachability works from your Composer files alone, with no access to your source and nothing to configure. Socket says it rules out around 60% of the vulnerabilities sitting in transitive dependencies.

Full application reachability reads your code alongside the dependency code, then reports whether the affected function is reachable and shows the call path that gets there. The claimed reduction in false positives is up to 90%.

PHP makes both of those hard. Static analysis breaks on __call, on classes instantiated from a variable, and on string-keyed service containers, which covers Laravel Facades, Eloquent relationships, Doctrine proxies, and anything wired through Symfony's DI container.

Pricing

Socket's pricing page puts precomputed reachability on the Team plan at $25 per developer each month, with a five-developer minimum. Full application reachability is Enterprise, which is custom priced. The free plan gives you 1,000 scans a month and blocks known malicious dependencies before they install.

The beta announcement has the full feature list, along with links to the research behind each of those attacks.