The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To find open-source code that was copied, vendored, embedded, or otherwise used without a package-manager declaration, combine a dependency-graph review with scans of source files and relevant build artifacts. Then investigate each candidate against upstream evidence, confirm whether it is included in the product you care about, and preserve the findings in a repeatable inventory such as an SBOM. A manifest scan alone cannot establish that a codebase contains no undeclared components.
What counts as undeclared open-source code?
A dependency is declared when package metadata—such as a manifest or lockfile—identifies it for a package manager or dependency-analysis system. Undeclared code is third-party code that may be present even though that metadata does not account for it. It can be copied into a project, vendored in a directory, embedded in another component, or included in a build artifact without an ordinary package-manager relationship.
This creates two related but distinct inventory problems. Dependency-graph analysis starts with declarations and resolves packages, including transitive dependencies where supported. Code and artifact scanning looks for evidence in the files themselves. The first is an efficient baseline; the second is needed to investigate copies that the package records do not describe.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors“Undeclared” is an inventory observation, not a legal or security verdict. A scanner match does not by itself establish the applicable license obligations, policy compatibility, vulnerability exposure, or whether the component ships to users. Those questions require separate validation and, when appropriate, review by engineering, security, or legal specialists.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Prepare a scan that can be repeated
Before running tools, define exactly what you are trying to inventory. A scan of a working tree answers a different question from an examination of a release package. Record a repository revision or other stable identifier and keep the scanner configuration with the results, so another reviewer can understand what was included and how a finding was produced.
Choose the scope based on the question
- For repository hygiene: identify the checkout and include relevant submodules, generated source, vendored directories, and test or example areas that could contain copied code.
- For shipped-product inventory: include the actual release artifacts or packaged outputs that are distributed. A source-only scan cannot establish which repository files make it into a product.
- For containerized or packaged delivery: identify the layers or package contents that are relevant to the release and record which artifacts were scanned.
- For a focused investigation: record why any directories or outputs are excluded. An exclusion can be reasonable, but it changes what the result means.
There is no universal scan boundary for every audit. The useful boundary is the one that matches the claim you need to make: what is in the repository, what is in a build, or what is actually distributed.
Keep the evidence together
For each scan, retain the revision or build identifier, the artifacts and paths examined, the tool and configuration versions, the report, and the eventual review decisions. This lets a later reviewer distinguish a changed codebase from a changed scanner configuration, and a newly found component from one that was simply missed in an earlier scope.
Build a declared-dependency baseline
Start by collecting package manifests and lockfiles and resolving dependency trees where possible. This captures the packages that the repository declares and, for supported ecosystems, can reveal transitive dependencies and the paths by which they enter the graph.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
GitHub Docs describes its dependency graph as automatically parsing dependencies by analyzing repository manifests and lock files. Its documentation says the graph can show detected dependency versions, license information, manifest paths, vulnerability state, and transitive paths for supported ecosystems; it also accepts submitted dependency data. Coverage therefore depends on the ecosystem and records available for the repository.
This baseline is valuable, but it is not a copied-code detector. A file copied from an upstream project into the repository may have no package record to resolve. GitHub’s documented graph summarizes manifest, lockfile, and submitted dependency data, so a separate source or artifact scan is necessary for the undeclared-code question.
Review the graph as a map, not a complete inventory
- Check that the relevant manifests and lockfiles are present and current for the revision being assessed.
- Use dependency paths to understand whether a package is direct or transitive, rather than treating every graph entry as a direct declaration.
- Note ecosystem support and any submitted dependency data that contributes to the graph; a missing graph entry is not proof that no third-party code exists.
- Keep this package-level baseline separate from source-scanner candidates so reviewers can tell which evidence came from metadata and which came from file contents.
Scan source files and build artifacts for code clues
Use a scanner that inspects file content and package clues, not only dependency declarations. ScanCode Toolkit documents detection of licenses, copyrights, package manifests, and direct dependencies in source and binary files. It can be run from the command line and in CI/CD. For broader orchestration, OSS Review Toolkit (ORT) can analyze dependencies and metadata, retrieve source, invoke configured scanners for license and copyright findings, evaluate policy, and produce reports or bills of materials.
These approaches are complementary. A source scanner may find a notice or code signature that does not appear in package metadata; an orchestrated workflow can bring dependency analysis, scanning, policy checks, and reporting into one process. The result still depends on what was scanned, which scanners were configured, and the evidence available in the files.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Look for more than one kind of signal
A candidate is more persuasive when independent clues point to the same origin. Useful evidence can include package metadata, version strings, license text, copyright notices, file paths, hashes, and similarity to upstream code. Preserve the specific evidence that triggered the finding rather than recording only a project name or automated label.
Each clue has limits. A license phrase may be common or copied from a template. A matching fingerprint may come from modified code or a fork. A package or source tree may appear in a test fixture without being shipped. Generated code can also complicate interpretation. Treat scanner output as a lead to investigate, not a confirmed component list.
Match the scan to the artifact
When the question concerns a release, scan the release artifacts as well as the source repository where practical. Record whether evidence came from a source path, a packaged file, or another artifact layer. This distinction matters: finding code in a repository does not by itself prove it is part of a distributed product, while a repository-only scan may miss content introduced or retained in a built artifact.
Recommended Free Tools
Validate and triage every candidate
For each plausible match, create a review record with the exact file path or artifact layer, scanner evidence, a relevant code or notice excerpt, the proposed upstream project, a confidence assessment, and a validation status. Then compare the candidate with upstream project files or release archives when available. Review version clues, license and copyright notices, repository history, and evidence that the file is included in the build or release under review.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Locate the evidence. Record the exact path, artifact, and match details so another reviewer can reproduce the inspection.
- Test the proposed origin. Compare the relevant content and metadata with upstream project material or release files when available. Record whether the evidence supports an exact, partial, modified, or uncertain match.
- Assess version confidence. Use version strings, package metadata, history, and other available clues together. If they do not establish a precise release, report the uncertainty rather than guessing.
- Check product inclusion. Establish whether the candidate is present in the source only, a test or example, a build output, or a distributed artifact relevant to the inventory.
- Route unresolved questions appropriately. Engineering can investigate provenance and build inclusion; security can assess exposure; legal reviewers can interpret license obligations. A scanner’s license label is not a legal conclusion.
- Document the decision. Keep the reviewer’s rationale, confidence, and status with the evidence, including when a candidate is rejected or remains unresolved.
Do not collapse identification, license interpretation, and security assessment into one field. A likely match can be useful even when its exact version is unknown; that uncertainty should remain visible to the people making downstream decisions.
Choose an approach by coverage and workflow
There is no source-supported head-to-head accuracy benchmark for these approaches. Compare them by the coverage and evidence they provide for your repository and delivery process, rather than relying on a single accuracy number or assuming one tool can prove completeness.
| Approach | Useful for | Important limitation | Evaluate |
|---|---|---|---|
| Manifest and lockfile dependency graph | Declared direct and transitive packages, versions, dependency paths, and some license or security context | Can miss copied or vendored code absent from package metadata; support varies by ecosystem | Ecosystem coverage, lockfile fidelity, transitive resolution, path evidence, and repository integration |
| Source and binary scanner | Package, license, copyright, and code clues found in files and artifacts | Findings need review; modified or partial copies can complicate matching | Source and binary coverage, evidence detail, provenance and version confidence, false-positive workflow, and privacy |
| Orchestrated SCA or compliance workflow | Combining dependency analysis, configured scanning, policy evaluation, reporting, and SBOM generation | Results depend on setup, ecosystem support, scanner configuration, and policy quality | Integration, repeatability, output formats, policy controls, deployment, cost, and maintainability |
ScanCode Toolkit is one documented option for source and binary scanning. ORT documents a configurable workflow spanning analysis, source retrieval, scanner orchestration, policy evaluation, and reporting. GitHub’s dependency graph is a convenient baseline where the repository’s manifests, lockfiles, and ecosystems are supported. Select on evidence quality and fit to the target artifacts, not on brand familiarity alone.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Generate an SBOM and preserve the scan record
Generate a software bill of materials (SBOM) when it helps communicate the inventory in a machine-readable form, and retain it with the scan report, configuration, and revision or build identifier. An SBOM records an inventory; it does not make an incomplete scan complete or convert a proposed scanner match into a confirmed component.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
ORT documents generation of SBOMs in SPDX and CycloneDX formats, as well as custom FOSS attribution documentation. GitHub documents repository SBOM endpoints that export SPDX JSON. Its documentation says the synchronous export operation is scheduled to close after November 13, 2026, and directs users to asynchronous generation and fetch endpoints. Teams relying on that export should follow GitHub’s current endpoint documentation and use the asynchronous route as directed rather than building a process around an operation scheduled to close.
For a useful audit trail, retain both the machine-readable output and the evidence needed to interpret it: what was scanned, what was excluded, the tool configuration, findings, and review decisions. A component list without provenance or scope is difficult to reproduce and easy to overstate.
Make detection part of ongoing change control
A one-time inventory can become stale as code, dependencies, and release contents change. Run appropriate checks on changes and releases, review dependency changes in pull requests, and define an owner and process for resolving policy findings. The exact gates should match the project’s risk and delivery model; the goal is to make new evidence reviewable rather than let an alert become an untracked label.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
GitHub documents dependency review for pull requests and license-compliance rules that can evaluate dependency changes, including transitive dependencies in the graph. GitHub’s license-compliance feature documentation describes the feature as public preview and limits it to organizations owned by an enterprise account with GitHub Code Security enabled. Verify current availability and eligibility before making it a required control. In any case, graph-based dependency review complements, rather than replaces, scanning for copied code that is not represented in dependency metadata.
Keep the control useful
- Run scans against identifiable revisions or releases so findings can be tied to a specific state.
- Review both package changes and code or artifact scan results; they detect different classes of evidence.
- Assign responsibility for confirming, rejecting, or escalating candidates, and preserve the reason for the decision.
- Revisit scanner scope and configuration when build outputs, ecosystems, or repository structure change.
- Maintain an SBOM or equivalent inventory alongside the evidence that explains its scope and confidence.
What a clean scan does—and does not—tell you
A clean result means the configured tools did not report candidates in the scope they examined. It does not prove the absence of every copied, modified, generated, or embedded component. A tool may lack coverage for a particular ecosystem or artifact, and code may not preserve recognizable notices or signatures. The defensible conclusion is bounded: state the revision and artifacts scanned, the tools and configuration used, and the limits of the resulting inventory.
Likewise, an alert is not automatically proof of a third-party component in the shipped product. Confirm the proposed origin, inspect the exact evidence, and establish build inclusion before using the result for licensing, security, or release decisions. This separation makes the inventory more credible and gives each reviewer the information relevant to their role.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
