Key takeaways
- Run a free advisory scanner (npm audit, Dependabot or OSV-Scanner) in every project: it is fast, precise and catches reported malware and CVEs.
- Advisory scanners miss malware in the hours or days before it is reported, which is when most installs of it happen.
- Socket is the most complete commercial product for malware detection: PR comments, an install firewall, many ecosystems, seat-based plans.
- Togoder Security reads the source of every dependency with AI, from a prepaid balance (top-ups from $20) or a monthly plan from $30, rather than per seat.
- Snyk is primarily a known-vulnerability (SCA) platform; it is not the cheapest way to get malware detection alone.
"Scan my dependencies for malware" covers two different jobs. One is checking versions against lists of packages someone has already reported as malicious. The other is looking at the code of versions nobody has reported yet. The first job is solved and free. The second is where tools differ.
Comparison table
| Togoder Security | Socket | Snyk Open Source | npm audit / Dependabot / OSV-Scanner | |
|---|---|---|---|---|
| Main approach | An AI model reads the source of every file in every dependency | Static and AI-assisted analysis of package behavior and risk signals | Matches versions against Snyk's vulnerability database | Match versions against public advisory databases |
| Finds unreported malware | Yes, that is its purpose (with false positives) | Yes, that is its focus | Mostly once it is in Snyk's database | No, only once an advisory exists |
| Known CVEs | No | Yes | Yes, its core strength | Yes |
| License checks | No | Yes | Yes | No (Dependabot: no) |
| Ecosystems | npm, PyPI, crates.io, Go, RubyGems, Packagist | npm, PyPI, Go and several more | Most major ecosystems | npm audit: npm only; OSV-Scanner and Dependabot: many |
| How you use it | Web upload, open-source CLI for CI (npx togoder-scan), HTTP API (API key) | GitHub app with PR comments, CLI, install-time firewall, dashboard | CLI, IDE, SCM integrations, dashboard | Built into npm / GitHub; OSV-Scanner CLI |
| Blocks installs | No | Yes (firewall) | No | No |
| Pricing model | Prepaid balance from $20, or monthly plans from $30 with a token budget for new code; cached files are free; no seats | Free plan; paid plans per developer | Free plan with limited tests; paid plans per developer | Free |
| Account needed | For scanning new code, yes (API key); public reports and lookups, no | Yes | Yes | No |
Prices of other tools change often; check their pricing pages. Facts about other tools reflect public documentation as of November 2026.
Free advisory scanners: npm audit, Dependabot, OSV-Scanner
npm audit matches your tree against the GitHub Advisory Database, which includes malware advisories. Dependabot does the same on GitHub and opens pull requests. OSV-Scanner reads many lockfile formats and uses the OSV database, which also imports the OpenSSF malicious-packages feed. All three are free and precise. None of them reads code, so a malicious version is invisible to them until someone reports it. Run one of them regardless of what else you choose. More in npm audit vs source code scanning.
Socket
Socket analyzes what packages do (install scripts, network and filesystem access, shell commands, obfuscation, typosquat names) and flags known malware. It runs as a GitHub app that comments on pull requests, a CLI, and a firewall that blocks malicious packages at install time, with a dashboard and policies for teams. It has a free plan and paid plans priced per developer. If you want malware detection wired into every pull request across a team, it is the most complete option. See Socket alternatives.
Snyk
Snyk Open Source is a software composition analysis (SCA) tool: it finds known vulnerabilities and license issues in your dependencies and suggests upgrades, as part of a platform that also covers your own code, containers and infrastructure as code. Its database includes malicious packages that have been reported, but finding unreported malware by reading dependency code is not its focus. See cheap Snyk alternatives for malware detection.
Open-source analyzers: GuardDog and others
GuardDog, from Datadog, is a free CLI that checks npm, PyPI and Go packages with Semgrep rules and metadata heuristics, such as install scripts that download code or exfiltrate environment variables. Rules are transparent and it runs locally. It is a good free complement; rule-based detection can be evaded by code that does not match a rule.
Togoder Security
Togoder Security downloads every package in your lockfile from the official registry, never runs it, and has an AI model read each source file. A fast screening model clears plain library code first; the rest gets a full review for install-time payloads, credential theft, exfiltration, obfuscation, backdoors, wallet drainers and miners. Each finding has a severity, file, line and a stable ID you can ignore in later scans. How it works is documented in the methodology.
What makes it different:
- It reads the code, all of it. Not only packages with install scripts or a matching rule: every source file of every dependency, transitive ones included.
- No seats, no subscription needed. Top up a prepaid balance from $20, or take a monthly plan from $30 for any number of developers. Both work with API keys for CI and scripts.
- You pay for new code only. Verdicts are cached by each file's SHA-256, so files anyone has scanned before are free, and every result becomes a free public report.
- Six ecosystems: npm, PyPI, crates.io, Go, RubyGems and Packagist.
Where it is the wrong tool: it does not check known CVEs or licenses, does not block installs, has no GitHub app or team dashboard, and its verdicts are AI judgments that include false positives and can miss well-hidden code. Pair it with an advisory scanner.
Which should you use?
- Everyone: npm audit or OSV-Scanner in CI, a committed lockfile, and install scripts under control.
- A team that wants malware checks on every pull request and an install firewall: Socket.
- A team that also needs CVE and license management across code and containers: Snyk or a similar SCA platform.
- Small teams, solo developers, audits before a release, and AI agents that vet packages: Togoder Security, from a prepaid balance or on a monthly plan, plus a free advisory scanner.
Frequently asked questions
What is the best tool to scan npm dependencies for malware?
Combine a free advisory scanner (npm audit, Dependabot or OSV-Scanner) for reported malware with a tool that inspects code for unreported malware: Socket for team workflows with PR comments, GuardDog for free rule-based checks, or Togoder Security for an AI review of every file, from a prepaid balance or on a monthly plan.
Does Snyk detect malicious npm packages?
Snyk's database includes malicious packages once they have been reported, so it flags those. Detecting unreported malware by analyzing code is the focus of tools like Socket and source-review scanners.
Does Togoder Security replace npm audit?
No. It does not check known CVEs. Run npm audit or OSV-Scanner for known vulnerabilities and use source review for malicious code nobody has reported yet.