depdoctor

Analyze dependency health for npm projects. Detect bloat, outdated packages, vulnerabilities, and unused dependencies — all from one CLI tool.

Install

npm install -g depdoctor

Or run without installing:

npx depdoctor analyze

Commands

depdoctor analyze

Analyze every dependency in your project and get a health score.

depdoctor analyze
depdoctor analyze --json
depdoctor analyze --depcheck
depdoctor analyze --no-cache

| Flag | Description | |------|-------------| | --json | Output raw JSON instead of a table | | --depcheck | Include unused dependency detection | | --concurrency <n> | Number of parallel requests (default: 10) | | --no-cache | Bypass cache and fetch fresh data |

What it checks for each package:

• Current version vs latest version (proper semver comparison)
• Weekly download count from npm
• Bundle size (gzip) from Bundlephobia
• Known vulnerabilities via npm audit
• Deprecation status
• Last publish date (staleness)
• Multiple versions in lockfile
• Unused dependencies (with --depcheck)

Scoring (0–100 per package):

| Factor | Penalty | |--------|---------| | Deprecated | Capped at 5 | | Major version behind | -25 | | Minor version behind | -10 | | Patch version behind | -5 | | Low downloads (<1K/week) | -10 | | Stale (>2 years) | -20 | | Large bundle (>500KB gzip) | -10 | | Critical vulnerability | -30 | | High vulnerability | -25 | | Moderate vulnerability | -15 |

The project score is a weighted average — packages with more downloads have more influence.

depdoctor migrate

Find deprecated and stale packages with replacement suggestions.

depdoctor migrate
depdoctor migrate --fix
depdoctor migrate --github-token <token>

| Flag | Description | |------|-------------| | --fix | Automatically replace packages in package.json | | --github-token <token> | GitHub token for higher API rate limits | | --no-cache | Bypass cache |

Includes built-in migration hints for 20+ packages (moment, request, lodash, node-fetch, uuid, and more).

depdoctor badge

Generate a shields.io health badge for your README.

depdoctor badge
depdoctor badge --output README.md
depdoctor badge --ci 70

| Flag | Description | |------|-------------| | --output <file> | Append badge markdown to a file | | --ci <threshold> | Exit with code 2 if score is below threshold | | --no-cache | Bypass cache |

depdoctor serve

Launch a web dashboard to visualize your dependency health.

depdoctor serve
depdoctor serve --port 8080

| Flag | Description | |------|-------------| | --port <n> | Port to listen on (default: 4200) |

The dashboard includes:

• Score gauge with animated ring
• Sortable, searchable package table
• Issue summary badges
• Migration suggestions
• Badge generator
• Dark/light theme toggle

Caching

Results are cached in ~/.depdoctor/cache/ to speed up repeat runs:

• npm registry data: 1 hour
• Bundle size data: 24 hours
• GitHub commit data: 1 hour

Use --no-cache to bypass the cache and fetch fresh data.

Requirements

• Node.js 20 or later

License

MIT