Mend (formerly WhiteSource) is an enterprise SCA and SAST platform known for automated fix pull requests and a broad policy engine across large organisations. If you want a fast, anonymous dependency check without onboarding a full platform, DepWarden is a free alternative. Here's an honest comparison.
DepWarden needs no account and no source upload — you paste a manifest or scan a public repo, and it receives only the dependency manifest text. Exploitability ranking (KEV + EPSS + fix availability) is free, not metered behind a paid tier. Typosquat detection and OpenSSF Scorecard health are included on every scan, not an add-on, and there's no agent or repo-integration wizard to set up for a one-off check. It also offers a full compliance round-trip: ingest a CycloneDX/SPDX SBOM, then export an SBOM, an OpenVEX document and a NOTICE/license file.
To be fair: Mend offers automated fix pull requests via a GitHub/GitLab app that opens a PR bumping a vulnerable dependency automatically, and a mature policy engine for enforcing org-wide rules (license allow-lists, severity gates) across many repos and teams at once. Both require granting Mend read/write access to your source and repo settings. DepWarden deliberately doesn't do either — they're incompatible with the no-account, no-source-upload promise. If you're managing dependency policy across a large multi-repo organisation and want automated remediation PRs, Mend is built for that.
Paste a package-lock.json with an old dependency and see prioritised fixes and a one-command remediation in seconds. More: software composition analysis, free vulnerability scanner, DepWarden vs Snyk, DepWarden vs Black Duck, or the longer write-up: free Mend alternative.