Comparison · pkgscan.dev
Grype finds vulnerable versions. Argus finds malicious intent.
Grype tells you which known vulnerabilities a version matches. Argus tells you whether the code's trying to attack you. pkgscan runs both, because most supply-chain incidents aren't CVEs.
Scan a package or file · All comparisons
Where Argus is different
Intent vs inventory
Grype matches package versions against advisory data. Argus reads the package for behaviour: install hooks, credential access, staged payloads, exfiltration.
Offline and deterministic
Grype uses a baked database, so results are reproducible and fast. Argus is a hosted content engine. That tradeoff is known CVEs versus novel malicious code — and you want both.
Different incidents
A typosquat with a clean semver doesn't have a CVE. A CVE in a legitimate library isn't malware. Treating one number as both leads to bad calls.
Both in the report
Grype findings and Argus findings are shown separately. The summary only calls an artifact malicious when a malware engine says so.
How Argus and Grype compare
It's the clearest example of two engines answering different questions that happen to share the word 'block'.
| Capability | Argus | Opponent |
|---|---|---|
| Detection | ||
| Approach | Content + structure analysis | CVE matching against a baked DB |
| Flags novel malicious code | Yes | No |
| Reports known CVEs | No | Yes |
| Matches MAL- advisories | No | Yes |
| Reads executable code | Yes | Partial |
| Inputs and coverage | ||
| Artifact bytes | Yes | Partial |
| Registry PURL | Partial | Yes |
| SHA-256 only | No | No |
| Container / SBOM scanning | No | Yes |
| VS Code / Open VSX | Yes | Partial |
| Operations | ||
| Runs without setup | Yes | No |
| Open source | No | Yes |
| Works offline | No | Yes |
| Runs as a registry publish gate | Yes | No |
| Best at | Malicious intent in package code | Known CVEs at scale |
Choose Argus or Grype
Choose Argus when
- You need to know if a package's malicious, not merely vulnerable.
- The artifact's an extension or a freshly published package.
- You want a registry gate that blocks on behaviour.
- You need to separate malware from CVE noise in a report.
Choose Grype when
- You scan container images, filesystems or SBOMs.
- You need an offline, reproducible CVE database.
- You already have a vulnerability management process.
- You need distro-level package coverage.
Why pkgscan doesn't merge the two verdicts
Semantics
Both engines can return 'block', but for different reasons. pkgscan only calls an artifact flagged as malicious when Argus, SkillSpector or a MAL- advisory says so. Grype is reported as a vulnerability source, with its findings attached.
- A CVE in a dependency's a patch task, not a malware incident.
- A clean CVE scan says nothing about whether the package's a trojan.
- The report shows both, so neither signal hides the other.
One scan, two queues
Workflow
Use the Grype and OSV findings to drive patching, and the Argus findings to decide whether to install or block. pkgscan keeps the evidence for both in the same permalink.
- Share the report with the person who owns the dependency.
- Use the SHA-256 permalink to reference the exact bytes.
- Re-scan after a fix without losing the earlier result.
Questions about Argus vs Grype
Does Argus replace Grype?
No — pkgscan runs Grype for CVEs and Argus for malware. They cover different incidents, and both appear in the report.
Can Grype detect malware?
Grype's a vulnerability scanner. It matches versions against advisory databases; it doesn't analyse package behaviour for malicious intent.
Is Grype open source?
Yes, Anchore publishes Grype as open source. pkgscan runs it with a database baked at image build so scans are reproducible.
Compare Argus with other engines
vs GuardDog · vs SkillSpector · vs OSV · vs deps.dev
Machine-readable copy: /comparison.json.