"Supports npm" is a starting point for a question, not an answer. It may mean the tool reads a manifest file, or it may mean it resolves the full dependency tree, matches advisories, understands your lockfile and analyses how your code calls a package. Ask which level applies to each ecosystem you use.
Five levels of support
| Level | What the tool does | A gap to watch for |
|---|---|---|
| 1. Manifest | Reads declared dependencies from the manifest | Misses transitive packages |
| 2. Lockfile | Reads exact resolved versions | Lockfile formats and versions vary |
| 3. Advisory match | Matches versions against advisories for that ecosystem | Coverage of advisories differs by ecosystem |
| 4. Fix guidance | Suggests a fixed version that resolves cleanly | Breaking changes and peer constraints |
| 5. Code level analysis | Checks whether your code calls the affected function | Often supported for fewer languages |
A vendor may be at level 5 for one language and level 1 for another. A single logo for each ecosystem hides this.
Build your own support matrix
List every ecosystem your organisation really uses, including the awkward ones: a private registry, a monorepo with several package managers, build tools that generate dependencies and container images. Then fill in a table with a row for each and a column for each level.
Be specific. "Python" is not a row. "pip with a requirements file", "poetry with a lockfile" and "a conda environment" are three rows, and tools often treat them differently.
How to verify a cell
- Take a real repository for that ecosystem.
- Run the tool, and compare its dependency list with the package manager's own output, such as the tree command.
- Count missing or extra packages.
- Pick two advisories you know affect a package in the tree, and see whether both appear.
- Check what the tool says when it cannot parse a file. Silent failure is the worst result.
Keep screenshots in your trial folder.
Questions for the vendor
- Which package managers and lockfile versions are supported, and which are planned only?
- How are private registries handled, and does the tool send package names outside your network?
- What happens with a monorepo that has several ecosystems?
- For which languages is code level analysis available, and which are generally available as opposed to preview?
Ask for the answers in writing and keep them with the trial notes.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a dependency inventory distinguishes direct and transitive packages, which is the line between levels 1 and 2.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning and reachability analysis. For your own languages, check each cell of your matrix with the free scan at gold.safeguard.sh/scan before relying on any list of supported ecosystems.
Quick check
Is a lockfile required for good results?
It makes results much more accurate, since it records the exact versions in use. Without one, a tool has to guess at resolution.
Why does language support differ for code level analysis?
It needs a language specific understanding of how code calls other code, which is more work than reading a package list.
Last reviewed: 19 October 2026.
