Dependency Scanner

A tool for discovering dependencies recursively across package.json and common lock files, useful for finding vulnerabilities and package versions deeply nested in your projects.

Features

• Search pnpm-lock.yaml, yarn.lock, package-lock.json, npm-shrinkwrap.json, and package.json files recursively
• Accept packages via a -p comma-separated argument or via file/stdin (-f file, -f -, --stdin)
• Validate package names and basic semver versions; invalid lines are warned and ignored
• Works with piped input (e.g., clipboard via pbpaste) and can be run from any root path with -r
• Lightweight implementation using dynamic regex matching
• No external dependencies

Installation

Global Installation

Install globally using npm:

npm install -g @damusix/dep-scanner

Or using pnpm:

pnpm add -g @damusix/dep-scanner

Or using yarn:

yarn global add @damusix/dep-scanner

Run without Installation

You can also run dep-scanner directly without installing it globally using npx:

npx dep-scanner -p express,lodash

Usage

After installation, the dep-scanner command will be available globally.

Scan packages specified directly:

dep-scanner -p [email protected],lodash -r /path/to/repo

Scan packages from a file:

dep-scanner -f packages.txt -r /path/to/repo

Pipe clipboard or other stream into the scanner:

pbpaste | dep-scanner -f - -r /path/to/repo
pbpaste | dep-scanner --stdin -r /path/to/repo

Auto-detect piped stdin (no -p or -f):

pbpaste | dep-scanner -r /path/to/repo

Scan current directory:

dep-scanner -p express,react

Command Options

• -p: Comma-separated packages (version optional). Example: -p [email protected],@scope/[email protected],pkg2
• -f: File with newline-separated entries, format: package=version or package@version (version optional)
• -r: Root path to start searching from (defaults to current working directory)
• -h: Show help message

Examples

Finding a specific vulnerable package version:

dep-scanner -p [email protected] -r ~/projects/myapp

Checking multiple packages from a file:

Create a file vulnerable-packages.txt:

[email protected]
[email protected]
[email protected]

Then run:

dep-scanner -f vulnerable-packages.txt -r ~/projects

Quick clipboard scan (macOS):

Copy a list of packages to clipboard, then:

pbpaste | dep-scanner --stdin

Notes

• This tool uses dynamic regex matches and may produce false positives for unusual file formats
• It's intended for quick repository searches, not authoritative dependency resolution
• The tool searches through lock files and package.json without parsing them as JSON/YAML

Author

Danilo Alonso [email protected]

License

MIT

Repository

GitHub Gist