DepGuard review
Free, open-source npm audits with health grades and CI thresholds.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
DepGuard is an open-source Node.js command-line package for auditing npm dependencies. It suits solo developers and small teams that want a repeatable view of dependency health during development or continuous integration. The audit examines publish recency and maintainer count, license compatibility through SPDX checks, unpacked package size, dependency count, deprecation status, and whether installed packages are imported in JavaScript or TypeScript source files. Results include scores and letter grades for individual dependencies and the overall project.
The tool is free to use under an MIT-licensed npm package model. Teams can invoke it with npx, install it globally, add it as a development dependency, or call its programmatic audit API. JSON output supports automated processing, while threshold-based exit codes let a pipeline fail when health results fall below a chosen bar. GitHub Actions is the named integration, making the package a practical fit for repositories that already run npm checks in that environment.
DepGuard’s main distinction is the breadth of checks combined in one dependency-focused report: maintenance signals, licensing, package weight, deprecations with replacement messages, and unused dependency scanning. Its scope is also its boundary. The supported ecosystem is npm, and deployment is self-hosted, so organizations managing other package managers or seeking a broader, multi-ecosystem governance layer should choose an alternative. Small npm projects that value transparent, scriptable CI checks should find the feature set aligned with their workflow; larger or polyglot teams may need wider ecosystem coverage.
DepGuard pros and cons
- Where it wins
- Scores maintenance, licenses, size, deprecation, and unused dependencies
- Provides per-package and overall letter grades with JSON output
- Supports threshold-based CI failures, GitHub Actions, and a programmatic API
- Where it doesn't
- Focused on the npm ecosystem rather than multiple package managers
- Self-hosted deployment leaves operation and environment management to your team
- Broader projects may outgrow its narrow dependency-health scope
DepGuard fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update