@lowdep/depwarden

DepWarden CLI — scan your npm, yarn, or pnpm project for supply-chain vulnerabilities and SBOM generation.

Quick start

# No install needed — run directly with npx
DEPWARDEN_API_URL=https://depwarden.in \
DEPWARDEN_API_KEY=DEMO \
npx @lowdep/depwarden

Use DEMO as the API key for three free full-fidelity scans.
Get a permanent key at depwarden.in.

Installation

# Global
npm install -g @lowdep/depwarden

# Or per-project (then run via npx or npm scripts)
npm install --save-dev @lowdep/depwarden

Usage

npx @lowdep/depwarden [options]

The CLI auto-detects your lockfile (package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml) or falls back to package.json.

Options

| Flag | Default | Description | |------|---------|-------------| | --api-url <url> | DEPWARDEN_API_URL env | DepWarden server base URL | | --api-key <key> | DEPWARDEN_API_KEY env | API key (dw_live_… or DEMO) | | --formats <list> | html | Comma-separated report formats: html,pdf,xlsx,csv | | --report-types <list> | risk-summary | Report types to download | | --out <dir> | (skip download) | Directory to write downloaded reports | | --fail-on-error <bool> | true | Fail the process when gate result is fail | | --manifest-file <path> | (auto-detect) | Path to a specific lockfile or package.json | | --project <name> | conformance-fixture | Project name sent to the API | | --timeout <seconds> | 30 | Per-request timeout | | --retries <n> | 3 | Max retries on transient network errors | | --cache-dir <dir> | .depwarden-cache | Offline verdict cache directory | | --cache-grace <hours> | 24 | How long a cached verdict stays valid when offline | | --verbose / -v | false | Verbose retry and detection output |

Environment variables

| Variable | Description | |----------|-------------| | DEPWARDEN_API_URL | Base URL of your DepWarden instance | | DEPWARDEN_API_KEY | API key — use DEMO for free evaluation |

Exit codes

| Code | Meaning | |------|---------| | 0 | Clean scan, or gate failed with --fail-on-error false | | 1 | Gate result is fail (build should fail) | | 2 | Configuration / IO / network error with no cached verdict | | 3 | Invalid or revoked API key | | 4 | Quota exceeded or demo allowance exhausted |

GitHub Actions

- name: DepWarden SCA scan
  env:
    DEPWARDEN_API_URL: https://depwarden.in
    DEPWARDEN_API_KEY: ${{ secrets.DEPWARDEN_API_KEY }}
  run: npx @lowdep/depwarden --formats html --out reports

Download reports

npx @lowdep/depwarden \
  --formats html,pdf,xlsx \
  --out ./security-reports

Add to package.json scripts

{
  "scripts": {
    "security:scan": "npx @lowdep/depwarden --formats html,pdf"
  }
}

Offline mode

The CLI caches the last successful verdict in .depwarden-cache/. If the server is unreachable, it falls back to the cached result for up to 24 hours (configurable via --cache-grace).

💸 Enjoying this? Your wallet has feelings too.

The free tier is real — no account, no credit card, no sighing. But if you've been meaning to set up proper build gating, PDF reports your manager can pretend to read, and an audit trail for the one time a log4shell happens on your watch…

Upgrade at depwarden.in/pricing →

Plans start at a price that's genuinely less than your last debugging session cost in lost time. Use DEMO as your API key for three full-fidelity test drives before committing.

"I thought I didn't need this until I needed it." — every developer, eventually.

Links

• depwarden.in
• Documentation
• All plugins
• Pricing
• Support

License

Proprietary — © 2026 DepWarden. All rights reserved.
You may run this software. You may not modify, copy, or redistribute it.
See LICENSE for full terms.