DepGuard

At a glance

• Editor score
  7.2 / 10
• Pricing
  Free plan
• Best for
  Small npm projects wanting CI health checks
• Free plan
  Yes
• Paid from
  Free
• Package health scoring
  Yes
• Facts checked
  26 Sep 2026

• Where it wins

  • Scores maintenance, licenses, size, deprecation, and unused dependencies
  • Provides per-package and overall letter grades with JSON output
  • Supports threshold-based CI failures, GitHub Actions, and a programmatic API

• Where it doesn't

  • Focused on the npm ecosystem rather than multiple package managers
  • Self-hosted deployment leaves operation and environment management to your team
  • Broader projects may outgrow its narrow dependency-health scope

Our verdict on DepGuard

DepGuard is an open-source Node.js command-line package for auditing npm dependencies. It suits solo developers and small teams that want a repeatable view of dependency health during development or continuous integration. The audit examines publish recency and maintainer count, license compatibility through SPDX checks, unpacked package size, dependency count, deprecation status, and whether installed packages are imported in JavaScript or TypeScript source files. Results include scores and letter grades for individual dependencies and the overall project.

The tool is free to use under an MIT-licensed npm package model. Teams can invoke it with npx, install it globally, add it as a development dependency, or call its programmatic audit API. JSON output supports automated processing, while threshold-based exit codes let a pipeline fail when health results fall below a chosen bar. GitHub Actions is the named integration, making the package a practical fit for repositories that already run npm checks in that environment.

DepGuard’s main distinction is the breadth of checks combined in one dependency-focused report: maintenance signals, licensing, package weight, deprecations with replacement messages, and unused dependency scanning. Its scope is also its boundary. The supported ecosystem is npm, and deployment is self-hosted, so organizations managing other package managers or seeking a broader, multi-ecosystem governance layer should choose an alternative. Small npm projects that value transparent, scriptable CI checks should find the feature set aligned with their workflow; larger or polyglot teams may need wider ecosystem coverage.

Your product? Our editors can test DepGuard in depth and publish a review, labelled as paid · from $149/mo →

DepGuard pricing

DepGuard fact sheet

DepGuard integrations

DepGuard lists 1 integrations on its own site.

• GitHub Actions

Alternatives to DepGuard

• Sonatype LifecyclePolicy-driven SCA with broad ecosystem coverage, SBOMs, reachability, and continuous monitoring.9.2
• Endor LabsMaps vulnerable dependency reachability and connects findings to remediation workflows.8.8
• SocketBroad dependency risk coverage, with cloud-only deployment and paid plans from $25 per developer monthly.8.6

See all DepGuard alternatives →

Featured on iTechGuides

DepGuard is listed in our Open Source Package Health Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/depguard/"><img src="https://www.itechguides.com/best/badge/depguard.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update