Comparison · pkgscan.dev
deps.dev maps the package. Argus reads the code.
deps.dev is fast, free and works from a PURL alone, but can't see the install script. Argus sees the bytes and reads them — which is the only way to catch behaviour metadata never describes.
Scan a package or file · All comparisons
Where Argus is different
Identity vs artifact
deps.dev answers questions about a package identity: versions, dependencies, advisory links. Argus answers questions about the archive you're holding.
Zero-download coverage
deps.dev works without fetching the artifact, which makes it great for inventory and dependency graphs. It isn't a malware check, and it isn't trying to be.
Bytes change the answer
A package can have clean metadata and a malicious postinstall. Only content analysis sees the difference.
Layered by default
pkgscan runs deps.dev on eligible PURL scans and Argus when bytes are available. The report shows which engines actually ran.
How Argus and deps.dev compare
deps.dev's a metadata service; Argus is a malware engine. Comparing them is mostly about knowing which question you're asking.
| Capability | Argus | Opponent |
|---|---|---|
| Detection | ||
| Approach | Content + structure analysis | Package metadata and advisories |
| Flags novel malicious code | Yes | No |
| Reports known CVEs | No | Yes |
| Reads executable code | Yes | No |
| File-level findings | Yes | No |
| Inputs and coverage | ||
| Artifact bytes | Yes | No |
| Registry PURL | Partial | Yes |
| SHA-256 only | No | No |
| Dependency graph metadata | No | Yes |
| AI agent skills | Yes | No |
| Operations | ||
| Runs without setup | Yes | Yes |
| Open API / data | No | Yes |
| Runs as a registry publish gate | Yes | No |
| Cost | Free tier, paid plans | Free |
| Best at | Malicious behaviour in the archive | Identity, dependency and advisory metadata |
Choose Argus or deps.dev
Choose Argus when
- You've got the artifact and need a malware decision.
- The risk's in an install script or bundled code, not in the version number.
- You're checking a marketplace extension.
- You need a registry-side gate.
Choose deps.dev when
- You only have a PURL and no bytes.
- You need dependency and advisory metadata at scale.
- You're building an inventory or SBOM.
- You want a free, fast identity check before fetching anything.
The package that looks fine until it installs
What metadata misses
Metadata describes a package: name, version, declared dependencies, advisory links. It doesn't execute or read the postinstall script — and that's exactly where npm and PyPI malware usually lives.
- A malicious publish can reuse a known-good package name and clean metadata.
- Advisory links only exist after disclosure.
- Content engines are the only layer that sees the code before it runs.
Use metadata for reach, content for proof
Combining them
pkgscan runs deps.dev for identity-level signals and Argus for byte-level behaviour. If the artifact can't be fetched, the report says which engines were unsupported instead of pretending it was clean.
- Eligibility's visible per engine.
- The SHA-256 permalink ties the result to exact bytes.
- Public reports mean one scan answers the question for the next person too.
Questions about Argus vs deps.dev
Is deps.dev a malware scanner?
No — deps.dev provides package metadata, dependency information and advisory signals keyed to a PURL. It doesn't analyse package code.
Why does pkgscan run both?
deps.dev adds identity and advisory context even when no bytes are available. Argus adds content-based malware detection when they are. The report shows which engines ran.
Is deps.dev free?
Yes, Google's Open Source Insights API is free. pkgscan uses it for eligible package identities.
Compare Argus with other engines
vs GuardDog · vs SkillSpector · vs OSV · vs Grype
Machine-readable copy: /comparison.json.