Supply Chain
SCA tools that name the vulnerable package you already installed (2026)
A 2026 shortlist of software composition scanners. Public docs, not a malware-drop cookbook. SBOM overlap declared.
Expertise: Supply Chain · Level: Intermediate · 12 min read
An SBOM that never matches a CVE is a packing list.
The SBOM list names what you installed. SCA asks which of those names is already known-bad. Overlap declared. This page is scanners and PR bots. I will not publish a malicious-package recipe.
Six scanners. One OSV CLI. One GitHub bot. One Grype. Two commercial desks. One install watchdog. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| OSV-Scanner | Open CVE match on a lockfile you own | Apache-2.0 |
| Dependabot | PR bot on a GitHub remote you already use | GitHub terms |
| Grype | CVE match on an SBOM you already built | Apache-2.0 |
| Snyk Open Source | Commercial SCA with PRs people already know | Commercial (free tier) |
| Socket | Watch the install, not only the CVE id | Commercial (free tier) |
| FOSSA | License plus vuln desk for counsel | Commercial |
OSV-Scanner
Best for open CVE match on a lockfile you own
OSV-Scanner talks to the OSV database. You point it at a lockfile or SBOM you already have.
Key features
- OSV database
- Lockfile and SBOM in
- Apache-2.0
- CI they document
Why we like it
This is the hidden gem. A public database plus a CLI you can grep.
Limits
Database coverage varies by ecosystem. A match is not a reachability proof.
Dependabot
Best for pR bot on a GitHub remote you already use
Alerts and version PRs on GitHub. Turn it on before you buy a third SCA. GitLab has a sibling story.
Key features
- Alerts
- Version updates
- No extra binary
- GitHub-shaped
Why we like it
Honesty. Most lockfiles already live here.
Limits
GitHub-only. Reachability is thin. Noise on transitive trees.
Grype
Best for cVE match on an SBOM you already built
Grype consumes Syft SBOMs and images. The SBOM list already rows Syft. Here Grype is the match engine. Overlap declared.
Key features
- SBOM and image in
- Apache-2.0
- You run the binary
- Pairs with Syft
Why we like it
If you already emit Syft, do not pretend you need a fourth matcher first.
Limits
Match quality is the feed. Not a license legal desk.
Snyk Open Source
Best for commercial SCA with PRs people already know
Snyk OSS is the known developer SCA. CLI, PRs, a desk. Reachability stories they sell.
Key features
- CLI and PRs
- Reachability they document
- Many ecosystems
- Free and paid
Why we like it
Known shelf. If the org already has Snyk, do not add a twin.
Limits
Commercial gravity. Noise. We did not run a tenant.
Socket
Best for watch the install, not only the CVE id
Socket looks at package behavior and maintainer risk. Complementary to a CVE match. Overlap with SBOM is the name, not the job.
Key features
- Install-time signals they document
- GitHub app
- PRs
- Free and paid
Why we like it
A brand-new package has no CVE yet. That is the hole this row names.
Limits
Commercial. Heuristics. Not a substitute for OSV on known IDs.
FOSSA
Best for license plus vuln desk for counsel
FOSSA is the license compliance shelf that also does vulns. When counsel owns the ticket, this is the neighbor.
Key features
- License policies
- Vulnerability neighbor
- SaaS
- Commercial
Why we like it
SCA is not only CVE. A forbidden license is a ship blocker too.
Limits
Commercial. Legal workflow is the product. We did not run it.
What the internet thinks about SCA tools
SCA threads treat lockfile noise as the reason people disable the bot. We keep that line. A closed alert is not a reachability proof.
mxmehl on Hacker News, Jul 2026: “I love bots like Renovate and Dependabot for taking care of updating my projects’ dependencies. But I hate when bumped dependencies break things, especially if it’s the same version update across multiple projects!”
Prove OSV-Scanner still publishes
Confirm OSV-Scanner still publishes. Scan a lockfile you own. Do not publish a malicious package.
git ls-remote --heads https://github.com/google/osv-scanner.gitFAQs
Does SCA replace an SBOM?
No. SBOM names the parts. SCA matches known issues. Link both.
Dependabot or Snyk?
Start with the platform button. Buy a desk when reachability and license enter the ticket.
Is a CVE match enough?
No. Reachability and a maintainer event are different holes. Socket names the second.
Is this a scored bake-off?
No.
