Most dependency scanners only tell you about known CVEs. But a huge class of real supply-chain attacks has no CVE at all: typosquatting (publishing expresss to catch people who fat-finger express) and dependency confusion (publishing a public package with your internal name so it gets installed instead).
Trivy, Grype and Dependabot won't flag these — there's no advisory to match. By the time there is one, the malicious postinstall has already run in your CI.
A name that's a single edit away from a very popular package, but isn't that package, is almost always malicious or a mistake. That's exactly what DepWarden flags — for free, no account, and without uploading your source. A typosquat shows up as a HIGH supply-chain finding, for example "expresss :: Possible typosquat of express".
The same scan surfaces what classic tools skip: OpenSSF Scorecard health, deprecated packages, and end-of-life release lines — alongside OSV/KEV/EPSS-prioritized vulnerabilities. Everything runs in a session-isolated workspace, with nothing uploaded but the manifest text.
Connect the repo branch with a PAT and attach a schedule — daily, weekly or monthly — and DepWarden re-scans it automatically and emails a report. No agent to install, no account to provision.
Typosquatting and dependency confusion succeed because installers resolve names, not intent. A developer or an automated tool requests reqeusts instead of requests, or an attacker publishes a public package matching the name of one of your private internal packages, and the package manager happily fetches the malicious version. The payload usually runs in an install hook, so it executes the moment npm install or pip install runs — often inside CI, with access to tokens and secrets. Signature-based scanners are blind to this because there is no CVE yet; the only reliable defence is to flag suspicious names and newly-introduced packages before they install. That is the gap DepWarden is built to close, and it costs nothing to add to a pipeline.
Name-similarity checks are the first layer. On top of that, pin and review lockfiles, prefer scoped or namespaced packages for anything internal, and gate pull requests so a human approves every new dependency. DepWarden's diff mode supports that workflow directly by surfacing exactly what a change adds. Read more in our guide to software composition analysis, or compare approaches in the free Snyk alternative write-up. Try it on your own lockfile at depwarden.in — no sign-up.