A better cargo audit — typosquats, EOL crates, EPSS risk ranking for Rust

cargo audit reads your Cargo.lock and checks each crate against the RustSec Advisory Database. It's the standard Rust dependency security tool — fast, well-maintained, and free. But RustSec only tracks advisory-backed vulnerabilities. DepWarden adds the supply-chain and exploitability layer that RustSec doesn't cover.

What cargo audit misses

Typosquatting on crates.io. A crate named serede (vs the popular serde) or tokio-async (vs tokio) can slip into a Cargo.toml as a simple typo. cargo audit has no detection for this; DepWarden runs name-similarity checks across your entire dependency tree.

End-of-life crates and abandoned maintenance. There's no "Rust EOL" in the same sense as Python or Node, but individual crates go unmaintained, get marked deprecated, or transfer ownership in ways that signal supply-chain risk. DepWarden surfaces OpenSSF Scorecard scores, deprecation markers and last-commit staleness alongside known CVEs.

Exploitability context beyond RustSec. RustSec is Rust-specific and excellent. But CVEs in C libraries linked via Rust FFI, in system dependencies, or in cross-language projects that mix Rust with another ecosystem won't appear in RustSec. DepWarden uses the OSV mirror across all ecosystems plus CISA KEV and FIRST EPSS so polyglot Rust projects get a complete picture.

A "fix these first" priority order. cargo audit doesn't tell you which of your 15 advisories are currently being exploited in the wild. DepWarden's "Fix these first" view filters by KEV status, EPSS probability, direct vs transitive depth, and fix availability — so you spend time on the findings that matter.

Supported Rust manifest formats

Cargo.lock (exact pinned dependency tree — always use this for audit)
Cargo.toml (parsed for declared dependencies when no lockfile present)

Usage

Browser: paste your Cargo.lock at depwarden.in — no account, no install. Connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch directly for a one-off or scheduled scan.

Combining with cargo audit

cargo audit and DepWarden are complementary, not competing. cargo audit has the deepest RustSec integration and runs natively in Rust CI pipelines. DepWarden adds supply-chain signals, cross-ecosystem coverage, and exploitability ranking. Running both takes under a minute and catches different risk classes.

For polyglot Rust projects

Many Rust services embed Python scripts for tooling, use Node for frontend, or call Go binaries. DepWarden scans all supported manifest formats in a single pass, so a monorepo with Cargo.lock + package-lock.json + requirements.txt gets one consolidated report.