DepWarden for npm, yarn and pnpm

The @lowdep/depwarden npm package is a lightweight CLI that reads your lockfile, resolves the full dependency graph, and streams results back from the API. It supports npm, yarn, and pnpm lockfiles out of the box.

Prerequisites

Node.js ≥ 18
npm / yarn / pnpm in PATH

Install and run

1. Install

npm install --save-dev @lowdep/depwarden
# or
yarn add --dev @lowdep/depwarden
# or
pnpm add -D @lowdep/depwarden

2. Set your API key

export APP_API_KEY=dw_xxxxxxxxxxxxxx

3. Run a scan

npx @lowdep/depwarden

# Specify a lockfile if auto-detection fails:
npx @lowdep/depwarden --manifest-file yarn.lock

4. Add to package.json scripts

{
  "scripts": {
    "security:scan": "npx @lowdep/depwarden --formats html,pdf"
  }
}

Configuration

--api-key / APP_API_KEY — Your DepWarden API key. Use DEMO for three free full-fidelity scans.
--project (default my-project) — Project name sent to DepWarden — pass this explicitly.
--fail-on-error (default true) — Exit 1 when the server-side gate result is "fail". Pass false to run advisory-only and never block the build.
--formats (default html) — Comma-separated report formats: html, pdf, xlsx, json, csv.
--manifest-file — Path to lockfile. Auto-detected if omitted.
--out (default depwarden-reports) — Directory where reports are written.
--api-url (default https://depwarden.in) — Override API base URL for self-hosted deployments.

Failing the build

The CLI follows the server-side gate verdict (driven by your workspace's Policy rules) rather than a client-side severity threshold: it exits 1 when the gate result is "fail". Pass --fail-on-error false to run advisory-only and never block the build. For a client-side severity threshold instead, use the Maven plugin or GitHub Action, both of which support one directly.

Report formats

HTML (default)
PDF
Excel (XLSX)
JSON (CycloneDX SBOM)
CSV

Every scan can also export a CycloneDX SBOM.