Notes on free, privacy-first software composition analysis, supply-chain security and CI dependency scanning. DepWarden is a free, anonymous SCA tool: it scans your dependencies against live OSV, CISA KEV and FIRST EPSS data, catches typosquats and dependency confusion, and ranks every finding by real-world exploitability — no account, no source upload.
These articles go deeper on the topics that matter for modern dependency security: how to evaluate a software composition analysis tool, why exploitability-first prioritisation (CISA KEV + FIRST EPSS) beats triaging a wall of CVSS scores, how to block typosquatting and dependency-confusion attacks in continuous integration before a malicious package runs, and how a free, anonymous scanner compares to paid platforms like Snyk, Black Duck and Mend. Each post is practical and tool-agnostic — you can apply the ideas with DepWarden or anything else.
Software supply-chain security has moved from a niche concern to a board-level one. The overwhelming majority of the code in a modern application is open source you didn't write, pulled in transitively through dozens of layers of dependencies. That is enormous leverage for productivity and an equally large attack surface: a single compromised or abandoned package can expose every application that depends on it. The posts below focus on the practical, low-cost controls that actually reduce that risk — continuous dependency scanning, prioritising by real exploitability rather than raw severity, catching malicious packages that have no CVE, and turning a bill of materials into an ongoing assessment instead of a one-time snapshot.
Latest articles
Free, anonymous Snyk alternative for scanning — DepWarden is a free SCA tool that scans dependencies for vulnerabilities, typosquats, risky licenses and end-of-life packages — no account, no source upload.
Free, anonymous Black Duck alternative for scanning — DepWarden is a free SCA tool that scans dependencies for vulnerabilities, typosquats, risky licenses and end-of-life packages — no account, no source upload, no sales call.
Free, anonymous JFrog Xray alternative for scanning — DepWarden is a free SCA tool that scans dependencies for vulnerabilities, typosquats, risky licenses and end-of-life packages — no account, no Artifactory platform required.
CVSS, EPSS and KEV: prioritize vulnerabilities — Three scoring systems, one goal — fix the right things first. A practical guide to cutting through vulnerability noise with exploitability data.
What is an SBOM and why your team needs one — An SBOM is a machine-readable inventory of every open-source component in your software — what they contain and when they matter.
Log4Shell's supply-chain security lessons — The December 2021 Log4j vulnerability hit hundreds of millions of systems. The supply-chain lessons still are not universally applied.
How npm typosquatting attacks work — Attackers publish packages named to catch typos or shadow private ones. These attacks have no CVE and are missed by most scanners.
Open-source license compliance for developers — A practical guide to the licenses your dependencies carry, what they require from you, and how to stay compliant without a legal team.
SAST vs SCA: why your CI pipeline needs both — SAST finds bugs in the code you write; SCA finds bugs in the code you import. Their blind spots are almost perfectly complementary — here is how to run both.
What is SAST? A developer's guide — SAST analyses source code for vulnerabilities without executing it. How pattern matching, AST analysis and taint tracking work in CI.