Depmoor: Dependency Vulnerability Scanner
In-depth reviewDepmoor is a dependency vulnerability scanner that ranks advisories by real-world risk, using CISA KEV and EPSS exploit odds. It provides a ranked fix list with the fixing version from your lockfile. Supported ecosystems include npm, Python, Java, Go, Rust, PHP, Ruby, and .NET. Lockfiles are processed on your device.
Depmoor: Dependency Vulnerability Scanner, as it opens in a browser tab.
Not sure how to add Depmoor: Dependency Vulnerability Scanner to your home screen? Step-by-step for Chrome, Safari, Firefox and Edge — it takes about ten seconds, and there is no app store involved.
Own Depmoor: Dependency Vulnerability Scanner? Have us re-run this measurement — we open it in a real browser, cut the network, and send you what survived.
How to install Depmoor: Dependency Vulnerability Scanner as a PWA
Screenshots
2 images · scroll →
Why we recommend Depmoor: Dependency Vulnerability Scanner
Depmoor distinguishes itself by ranking dependency vulnerabilities using CISA's Known Exploited Vulnerabilities (KEV) catalog and FIRST's EPSS exploit probability scores. This means developers and security teams can prioritize fixing issues actively exploited in the wild or with a high chance of exploitation, rather than sifting through all reported advisories. It offers a single upgrade path per package and consolidates reporting across multiple ecosystems, including npm, Python, Java, Go, Rust, PHP, Ruby, and .NET. The app also emphasizes privacy, processing lockfiles locally in the browser, with only package names and versions sent to external APIs.
Best use cases
Best for: Development teams and security engineers who need to quickly identify and prioritize critical dependency vulnerabilities. It's ideal for integrating into CI/CD pipelines via its API to automatically fail builds on 'fix-now' issues. Teams managing projects across various programming languages can benefit from its unified reporting. Individual developers can use the free tier for quick scans to understand the real-world risk of their project's dependencies before committing code.
Honest limitations
Depmoor does not provide offline support as it requires a connection to OSV.dev and FIRST's EPSS API to fetch advisories and exploit data. While a free tier is available for 5 scans a day, unlimited scans, advanced features like CSV/SARIF exports, and the CI API are part of its paid 'Pro' and 'Team' plans. The free version does not offer features like 'new since last scan' or saved projects.
Are you the maker of Depmoor: Dependency Vulnerability Scanner? Claim this listing →
Similar to Depmoor: Dependency Vulnerability Scanner
Decode, verify, and generate JSON Web Tokens in the browser. Paste a JWT and instantly see the header, payload, and signature. The go-to debugging tool for auth developers.
A single-purpose utility that generates secure, hard-to-guess passwords at the click of a button. Users who need a fresh random password for a new account can produce one instantly in the browser. A lighter-weight companion to full password managers such as Bitwarden or 1Password.
Open-source password manager — the best LastPass alternative. End-to-end encrypted vault, browser extension, cross-device sync. Free for personal use, self-hostable. Vaults stay readable offline once the app is installed, so a lost connection never locks you out of your own passwords.
A secure password generator that brings the pwgen command-line tool's approach to the browser. It creates random passwords and is offline-capable, so credentials can be generated without sending anything over a network. Suited to developers and privacy-conscious users who want pwgen-style passwords on any device.
A single web page that uses local JavaScript to calculate time-based one-time password (TOTP) codes for two-factor authentication, and works offline. It acts as a browser-based alternative to authenticator apps like Google Authenticator for users who want to generate 2FA codes without a phone app or sending secrets to any server.
Open-source, end-to-end encrypted password manager and digital wallet. Self-hostable, audited codebase, beautiful UI. A worthy Bitwarden alternative for privacy-focused teams. The vault is encrypted before it leaves the device, so a self-hosted server stores data it cannot read.
Own a PWA? See the listing options — standard submission is free.