Dependency scanners

These tools report known-vulnerable or malicious packages you already depend on. A clean result does not mean the app checks authorization.

Last updated Oct 13, 2026

Scanner comparison. Rows are alphabetical, not ranked.
Tool	Price	What it catches	Who it suits
GitHub Dependabot	Alerts, security updates, version updates, and malware alerts are listed for all GitHub plans, without buying GitHub Code Security. A numeric private-repo quota was not on the overview page.	Known vulnerabilities in dependencies, with optional pull requests. Dependency review on private repos is part of GitHub Code Security.	A repository already on GitHub.
npm audit	Included with the npm CLI. No separate price. Specific flags were not re-verified because the docs URL returned an error on the day the tool page was written.	Known vulnerabilities in the packages installed in a JavaScript project.	A local check before you open a pull request. Read the advisory before a major upgrade.
Snyk	The $0 Free plan includes SCA along with SAST, IaC, and containers. The free-plan test count is not stated on the plans page.	Known problems in open-source dependencies, from the IDE, CLI, or git host.	Someone who wants dependency and code results in the same Snyk account.
Socket	Free plan at $0 per developer: unlimited developers and repos, 1,000 scans per month, 500 API requests per hour, 3 members. The FAQ says open source stays free.	Malicious or surprising dependency behavior, plus known vulnerabilities and license issues. Source code stays local; Socket receives the dependency list.	A project that installs packages an agent added, including packages that have no CVE yet.

Sources

Each cell is a shorter restatement of that tool's page on this site. The tool page lists the public URL that was checked and anything still unknown.