Most "dependency scanners" only tell you about known CVEs. But a huge class of real supply-chain attacks has no CVE at all: typosquatting (publishing expresss to catch people who fat-finger express) and dependency confusion (publishing a public package with your internal name so it gets installed instead).
Trivy, Grype and Dependabot won't flag these — there's no advisory to match. By the time there is one, the malicious postinstall has already run in your CI.
The cheap, effective check
A name that's a single edit away from a very popular package, but isn't that package, is almost always malicious or a mistake. That's exactly what DepWarden flags — for free, no account, and without uploading your source. Connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch with a PAT and schedule recurring scans, and every run checks your lockfile for these names again.
A typosquat shows up as a HIGH supply-chain finding:
[HIGH] expresss :: Possible typosquat of "express"
Beyond typosquats
The same scan surfaces what classic tools skip: OpenSSF Scorecard health, deprecated packages, and end-of-life release lines — alongside OSV/KEV/EPSS-prioritized vulnerabilities.
Try it on your own lockfile at depwarden.in — no sign-up required.
Top comments (0)