Key takeaways
- Free: lockfiles, npm ci, Dependabot or Renovate, OSV-Scanner or npm audit, install-script allowlists, 2FA.
- Malware detection needs a tool that looks at code; advisory scanners only catch reported malware.
- A prepaid balance or a flat monthly plan (Togoder Security) or a free tier (Socket, GuardDog, Aikido Safe Chain) fits small teams better than per-developer platforms.
- Add SBOMs and SCA platforms when customers or compliance ask for them.
Layer 1: free basics
| Risk | Free control |
|---|---|
| Unexpected versions | Commit lockfiles; npm ci, pip install --require-hashes, cargo build --locked |
| Known vulnerabilities and reported malware | Dependabot alerts, OSV-Scanner, npm audit, pip-audit, cargo audit, govulncheck |
| Install-time payloads | ignore-scripts, pnpm onlyBuiltDependencies, Bun trustedDependencies |
| Brand-new malicious versions | A minimum release age in pnpm or Yarn; delayed update PRs in Renovate or Dependabot |
| Your own packages hijacked | 2FA, trusted publishing, no long-lived tokens in CI |
| Typosquats and hallucinated names | Check names before adding them; see typosquatting and slopsquatting |
Layer 2: malware detection
Everything above either prevents code from running or relies on someone having reported a problem. To catch a malicious version before it is reported, something has to look at the code. Options that suit a small budget:
- Togoder Security: AI review of every file in your lockfile. A prepaid balance (top-ups from $20) or a monthly plan from $30 for the whole team; no seats, and files scanned before are free. npm, PyPI, crates.io, Go, RubyGems, Packagist.
- Socket: GitHub app and firewall with a free plan; paid plans per developer.
- GuardDog: free open-source rule-based scanner for npm, PyPI and Go.
- Aikido Safe Chain: free tool that blocks known malware at install time.
When to run it: whenever the lockfile changes in a pull request, and before each release. Comparison: npm malware scanners compared.
Layer 3: when you grow
Customer security questionnaires and compliance frameworks eventually ask for SBOMs, license policies and vulnerability SLAs. That is when an SCA platform such as Snyk or a similar product starts paying for itself.
Frequently asked questions
What are the best software supply chain security tools for a small team?
Start with free tools: committed lockfiles, Dependabot or OSV-Scanner, and install scripts disabled by default. Add malware detection that reads code, such as Togoder Security from a prepaid balance or on a monthly plan, Socket's free plan or GuardDog. Add an SCA platform when compliance requires it.