When a potential issue is detected in a package, we flag it for review and request ChatGPT to summarize its findings.

Socket is now utilizing AI-driven source code analysis with ChatGPT to examine every npm and PyPI package.

Now, we are excited to announce the general availability of our AI-driven analysis solution! Our internal threat feed has been powered by GPT-3, and more recently, GPT-4, for several months, demonstrating impressive results, particularly when analyzing uncommon code patterns. We have been dedicated to exploring these systems, refining tools that capitalize on their strengths and minimize their weaknesses. AI systems like ChatGPT, while still in their infancy, offer immense potential. Scaling human analysis to cover the entire npm registry has been prohibitively expensive and time-consuming-until now.Įnter ChatGPT: one of the most transformative technologies of our time.Īt Socket, we have been using AI for a while now to tackle these challenges. Traditional rules-based approaches often prove too inflexible, resulting in either excessive noise or overlooked critical details. Despite our best efforts to analyze parts of it with static analysis and graph queries, capturing all the subtleties that an attentive review can provide remains a challenge. The npm registry is vast, complex, and difficult to navigate.

Py pi