lockcheck

Validates that your lockfile is in sync with package.json. Works with npm, yarn, and pnpm. Zero dependencies.

Catches the silent bug where someone edits package.json (adds/removes a dep) without running install, then pushes code that breaks for everyone else.

Install

npm install -g lockcheck

Or without installing:

npx lockcheck

Usage

# Check current directory
lockcheck

# Check a specific project
lockcheck ./backend

# CI / git-hook mode — exit 1 on any issue
lockcheck --strict

# Check multiple projects
lockcheck ./frontend ./backend ./shared

Example Output

In sync:

lockcheck  my-app
  npm · package-lock.json · 42 declared deps

  ✓ Lockfile is in sync. All 42 declared deps found.

Out of sync:

lockcheck  my-app
  npm · package-lock.json · 45 declared deps

  ✘ 3 package(s) in package.json not found in lockfile:
      express
      cors
      helmet

  Run `npm install` to update the lockfile.

Stale lockfile:

  ⚠  package-lock.json is older than package.json — you may need to run install

As a Git Hook

Add to .git/hooks/pre-push (or use with husky):

#!/bin/sh
npx lockcheck --strict

Make it executable:

chmod +x .git/hooks/pre-push

CI Integration

# .github/workflows/lockcheck.yml
- name: Validate lockfile
  run: npx lockcheck --strict

Supported Package Managers

| Manager | Lockfile | |---|---| | npm | package-lock.json (v1, v2, v3) | | yarn | yarn.lock (classic & berry) | | pnpm | pnpm-lock.yaml |

Checks Performed

1. Missing packages — deps declared in package.json not found in the lockfile
2. Stale lockfile — package.json was modified more recently than the lockfile (warn by default, error with --strict)

License

MIT

Keywords

lockfile · package-lock.json · yarn.lock · pnpm-lock · dependency check · lockfile sync · npm ci · stale lockfile · zero dependencies · cli

Built to solve, shared to help — Rushabh Shah 🛠️✨

One of 40+ zero-dependency developer CLI tools — no node_modules, ever.