pkg-lens

Zero-config CLI to detect and visualize dependency bloat in JavaScript/TypeScript projects.

npx pkg-lens

No installation required. Within seconds you'll see exactly which packages are bloated, how many lines of code they contribute, and what they can be replaced with.

Why

JavaScript dependency trees carry significant dead weight:

• The average npm package pulls in 85+ sub-dependencies
• Many packages still ship compatibility layers for engines nobody uses
• Hundreds of micro-packages exist as 3–20 line wrappers around native APIs
• Ponyfills for features natively available since 2017–2019 are still widely installed
• Every unnecessary package is a security supply chain risk

Existing tools like knip, e18e CLI, and bundlephobia solve adjacent problems — but none combine LOC counting + bloat classification + local tree analysis in one place.

Features

• Zero config — runs with no flags, auto-detects package manager and project root
• LOC counting — counts actual lines of JavaScript/TypeScript per package
• Bloat classification — categorizes packages as stale ponyfills, micro-packages, legacy compat, or duplicates
• Replacement suggestions — cross-references the e18e module-replacements dataset
• Dependency chains — traces who pulled in each flagged package
• Offline-first — works from your lockfile, no registry lookups
• Lean — under 10 direct dependencies (it would be embarrassing for a bloat-detection tool to have 200)

Usage

# Scan current directory
npx pkg-lens

# Scan a specific project
npx pkg-lens --dir /path/to/project

# Output as JSON (for piping or CI)
npx pkg-lens --json

# Filter by bloat type
npx pkg-lens --only ponyfill    # only stale ponyfills
npx pkg-lens --only micro       # only micro-packages
npx pkg-lens --only compat      # only legacy compat
npx pkg-lens --only duplicate   # only duplicates

# Minimum LOC threshold
npx pkg-lens --min-loc 5        # only packages above 5 LOC

# Launch browser UI (coming in v0.2.0)
npx pkg-lens --ui

Output

pkg-lens v0.1.0 — analyzing: my-app (847 packages)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  STALE PONYFILLS  12 packages · ~18k LOC removable
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  globalthis        18 LOC  →  globalThis (native since 2019)
  ↳ your-app → babel-preset-env → es-abstract → globalthis

  object.entries    32 LOC  →  Object.entries() (native since 2017)
  ↳ your-app → eslint-plugin-react → object.entries

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  MICRO-PACKAGES  34 packages · could be inlined
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  shebang-regex      3 LOC  single consumer: shebang-command
  path-key           9 LOC  single consumer: npm-run-path

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  847 packages scanned · 46 flagged · 761 clean

Bloat Types

| Type | Description | Example | |---|---|---| | Stale Ponyfill | Native replacement exists | globalthis → globalThis | | Micro-Package | Under 20 LOC, could be inlined | path-key, shebang-regex | | Legacy Compat | Supports very old engines | has, hasown, es-abstract | | Duplicate | Multiple versions in tree | is-wsl v2.2.0 and v3.1.0 |

How It Works

1. Scans node_modules — walks all .js, .mjs, .cjs, .ts files per package
2. Counts LOC — non-empty, non-comment lines only
3. Parses your lockfile — supports npm, pnpm, and yarn formats
4. Classifies bloat — cross-references against the e18e module-replacements dataset
5. Traces dep chains — shows exactly who pulled in each flagged package

Comparison

| Tool | What it does | What it misses | |---|---|---| | pkg-lens | LOC + bloat type + dep chains + replacements | — | | knip | Finds unused deps/exports | No bloat classification, no LOC | | e18e CLI | Flags replaceable direct deps | CLI only, no visualization, no LOC | | bundlephobia | Shows bundle KB per package | Not local tree, no bloat typing | | depcheck | Finds unused deps | Archived, no bloat analysis |

Requirements

• Node.js 18+
• A project with node_modules installed
• A lockfile (package-lock.json, pnpm-lock.yaml, or yarn.lock) for dependency chain info

Roadmap

• v0.2.0 — Interactive browser UI with sortable tables, filters, and dependency graph visualization
• Future — CI/CD integration mode, config file for ignoring packages

License

MIT