A free, anonymous Snyk alternative for dependency scanning

If you've shopped for Software Composition Analysis (SCA), you've hit the same wall: the good tools (Snyk, Black Duck, Mend, JFrog Xray) want an account, gate the useful parts behind a paywall, and upload your project to their cloud.

DepWarden is a free, anonymous alternative. You paste a manifest, a lockfile, or an SBOM — or point it at a public GitHub repo — and it runs in a private, session-isolated workspace. It never receives your source code, only the dependency manifest text.

Vulnerabilities, prioritized by real exploitability

Every component is matched against the full OSV mirror, then enriched with CISA KEV (actively exploited) and FIRST EPSS (exploit probability). Instead of a wall of CVSS scores, you get a "Fix these first" list that explains why — "actively exploited + fix available + direct dependency." That's the noise reduction the paid tools charge for.

Supply-chain risk CVE-only scanners miss

• Typosquats / dependency confusion — packages one keystroke from a popular one (expresss, loadsh) before they reach your build.
• Dependency health — OpenSSF Scorecard, deprecation, and end-of-life release lines (e.g. "django 2.2 stopped receiving security fixes in 2022").

Actionable remediation

Not just "a CVE exists" but a batch plan — "upgrading 3 packages clears 7 findings" — plus a copy-paste fix command for your ecosystem.

Compliance round-trip

Ingest an existing CycloneDX or SPDX SBOM; export a CycloneDX SBOM, an OpenVEX document, and a NOTICE / license-obligations file.

Repeat scans with no account

Connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch with a personal access token and attach a schedule — daily, weekly or monthly — and DepWarden re-scans it automatically and emails a report. No token retained beyond the scan.

Ecosystems

npm, PyPI, Maven, Gradle, Go, Cargo, Composer, RubyGems, NuGet, Dart, Swift — manifests, lockfiles and SBOMs.

What it deliberately doesn't do

No call-graph reachability and no auto-fix PRs — both need access to your source or a GitHub app with repo write, which would break the "no account, no source upload" promise. DepWarden trades that for privacy.

Try it: paste a package-lock.json with an old lodash and a typo'd package name and you'll see the prioritized fixes, the typosquat flag, and the one-command remediation in seconds. No sign-up, at depwarden.in.