How does Socket actually prevent NPM supply chain attacks?

I’ve been trying to find a real solution to NPM supply chain attacks (like the recent axios incident), and I keep seeing people mention Socket.

I checked their docs: https://docs.socket.dev/docs/socket-cli

But honestly… I’m a bit overwhelmed. There’s CLI, pricing, policies, tons of features — I still don’t really understand how it actually protects me in practice.

What I want is pretty simple:

I just want to run npm install and not get compromised.

And one more thing I’m curious about:

• Can Socket itself become a supply chain risk? (like if its detection rules or dependencies get compromised)

Would really appreciate if someone can explain how this works in real-world usage 🙏