If you've shopped for Software Composition Analysis (SCA), you've hit the same wall: the good tools (Snyk, Black Duck, Mend, JFrog Xray) want an account, gate the useful parts behind a paywall, and upload your project to their cloud.
DepWarden is a free, anonymous alternative. You paste a manifest, a lockfile, or an SBOM — or point it at a public GitHub repo — and it runs in a private, session-isolated workspace. It never receives your source code, only the dependency manifest text.
Every component is matched against the full OSV mirror, then enriched with CISA KEV (actively exploited) and FIRST EPSS (exploit probability). Instead of a wall of CVSS scores, you get a "Fix these first" list that explains why — actively exploited, fix available, direct dependency. That's the noise reduction the paid tools charge for.
Typosquats and dependency confusion are packages one keystroke from a popular one before they reach your build. DepWarden also surfaces dependency health: OpenSSF Scorecard, deprecation, and end-of-life release lines that no longer receive security fixes.
Not just "a CVE exists" but a batch plan — upgrading three packages clears seven findings — plus a copy-paste fix command for your ecosystem that installs only real, advisory-clearing versions.
Ingest an existing CycloneDX or SPDX SBOM; export a CycloneDX SBOM, an OpenVEX document, and a NOTICE / license-obligations file.
Connect a GitHub or Azure DevOps repo branch with a personal access token and schedule recurring scans with email reports — no account, no token retained beyond the scan. Across npm, PyPI, Maven, Gradle, Go, Cargo, Composer, RubyGems, NuGet, Dart and Swift.
No call-graph reachability and no auto-fix PRs — both need access to your source or a GitHub app with repo write, which would break the no-account, no-source-upload promise. DepWarden trades that for privacy. Try it: paste a package-lock.json with an old lodash and a typo'd package name and you'll see the prioritized fixes, the typosquat flag, and the one-command remediation in seconds. For more on the supply-chain side, read how to catch typosquats and dependency confusion in CI.