depcheck-ai

Smart dependency auditing for Node.js projects -- find outdated, vulnerable, and deprecated packages with risk scoring and upgrade suggestions.

npm audit only catches known CVEs. npm outdated only shows version diffs. depcheck-ai combines both and adds intelligent risk scoring, smart upgrade paths, and beautiful reports.

Demo

$ depcheck-ai

  depcheck-ai  Dependency Audit Report
  =====================================

  Project: my-app v2.1.0
  Scanned: 2026-03-19T14:30:00.000Z

  Summary
  -------
  Total dependencies:   24
  Outdated:              8
  Vulnerable:            2
  Deprecated:            1
  Overall health:       WARNING

  +-------------------+----------+----------+--------+----------+
  | Package           | Current  | Latest   | Risk   | Action   |
  +-------------------+----------+----------+--------+----------+
  | lodash            | 4.17.15  | 4.17.21  | HIGH   | Upgrade  |
  | express           | 4.18.1   | 4.21.0   | LOW    | Optional |
  | request           | 2.88.2   | -        | CRIT   | Replace  |
  | chalk             | 4.1.2    | 5.3.0    | SAFE   | Major    |
  +-------------------+----------+----------+--------+----------+

  Vulnerable packages:
    [email protected] - Prototype Pollution (GHSA-xxxx)
      Patched in: >=4.17.21
      Suggested:  npm install [email protected]

  Deprecated packages:
    [email protected] - Use 'undici' or 'node-fetch' instead

  Exit code: 1 (WARNING)

Install

npm install -g @chengyixu/depcheck-ai

Or run without installing:

npx @chengyixu/depcheck-ai

Usage

Scan the current project

depcheck-ai

Scan a specific directory

depcheck-ai /path/to/project

JSON output for CI/CD pipelines

depcheck-ai --json

Generate an HTML report

depcheck-ai --html report.html

Filter by dependency type

# Only production dependencies
depcheck-ai --prod

# Only dev dependencies
depcheck-ai --dev

# Include peer dependencies
depcheck-ai --peer

Verbose mode (full upgrade details)

depcheck-ai --verbose

CI/CD Integration

# GitHub Actions
- name: Dependency audit
  run: npx @chengyixu/depcheck-ai --json > audit.json

# GitLab CI
dependency_audit:
  script:
    - npx @chengyixu/depcheck-ai --json > audit.json
  artifacts:
    paths:
      - audit.json

Use exit codes to gate deployments:

| Code | Meaning | |------|---------| | 0 | Healthy -- no issues or only minor outdated packages | | 1 | Warning -- vulnerabilities or high-risk outdated packages | | 2 | Danger -- critical vulnerabilities found |

Why depcheck-ai over alternatives?

| Feature | depcheck-ai | npm audit | npm outdated | snyk | |---------|:-----------:|:---------:|:------------:|:----:| | Vulnerability scanning | Yes | Yes | No | Yes | | Outdated detection | Yes | No | Yes | Partial | | Deprecated package alerts | Yes | No | No | No | | Risk-level scoring | Yes | No | No | Partial | | Smart upgrade suggestions | Yes | No | No | Yes | | HTML reports | Yes | No | No | Yes | | JSON output | Yes | Yes | Yes | Yes | | CI exit codes | Yes | Yes | No | Yes | | Zero config | Yes | Yes | Yes | No | | Free & open source | Yes | Yes | Yes | Freemium |

Features

• Vulnerability scanning -- checks the npm advisory database for known CVEs
• Outdated detection -- queries the npm registry for latest versions
• Deprecated package alerts -- flags packages that authors have deprecated
• Risk scoring -- assigns risk levels (safe/low/medium/high/critical) based on multiple factors
• Smart upgrade paths -- suggests safe patch/minor updates vs. major upgrades needing review
• Multiple output formats -- CLI tables, JSON, and HTML reports
• Fast parallel scanning -- checks 8 packages concurrently
• CI/CD ready -- exit codes and JSON output for automated pipelines
• Zero config -- just point it at any directory with a package.json

License

MIT