npm-xray

Know everything about an npm package before you install it.

You find a package with 10K stars. You npm install it. Turns out it pulls 87 sub-dependencies, hasn't been updated in a year, and the maintainer abandoned it.

npm-xray gives you the full picture before you commit.

Install

npm install -g npm-xray

Usage

npm-xray <package-name>

Examples

# Full analysis
npm-xray express

# Skip dependency tree (faster)
npm-xray lodash --no-tree

# Skip alternative suggestions
npm-xray react --no-alternatives

# JSON output
npm-xray axios --json

# Deeper dependency tree
npm-xray webpack --depth 5

What You Get

• Health Score (0-100) — Weighted composite across 5 categories
• Maintenance — Publish frequency, last update, version history
• Security — Known CVEs via OSV.dev vulnerability database
• Dependencies — Direct + transitive count, full dependency tree visualization
• Community — GitHub stars, issue close ratio, last commit, archived status
• Bundle Size — Minified + gzipped size, tree-shakeability, side effects
• Download Trends — Weekly/monthly/yearly stats with sparkline chart
• Alternatives — Similar packages ranked by quality, popularity, and maintenance
• Verdict — Clear recommendation based on overall health

Example Output

  HEALTH SCORE
  ███████████████████████████░░░ 90/100

  ⚠  WARNINGS
    • 28 direct dependencies — very heavy

  ✓  POSITIVES
    • Recently published
    • No known vulnerabilities
    • 97.2% issues closed

  VERDICT
  ✓ This package looks healthy. Safe to install.

Options

| Flag | Description | |--------------------|--------------------------------------| | --no-tree | Skip dependency tree analysis | | --no-alternatives| Skip alternative package suggestions | | --depth <n> | Dependency tree depth (default: 3) | | --json | Output raw JSON |

GitHub Token

To avoid GitHub API rate limits (60 req/hr), set a personal access token:

export GITHUB_TOKEN=ghp_your_token_here

License

MIT

Author

imsurajchahar