Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@11ty/dependency-tree
Advanced tools
Finds all JavaScript CommmonJS require() dependencies from a filename.
dependency-tree
Returns an unordered array of local paths to dependencies of a CommonJS node JavaScript file (everything it or any of its dependencies require
s).
dependency-tree-esm
for ES Modules.Reduced feature (faster) alternative to the dependency-tree
package. This is used by Eleventy to find dependencies of a JavaScript file to watch for changes to re-run Eleventy’s build.
⚠ A big caveat to this plugin is that it will require the file in order to build a dependency tree. So if your module has side effects and you don’t want it to execute—do not use this!
npm install --save-dev @11ty/dependency-tree
node_modules
nodeModuleNames
to control whether or not node_modules
package names are included (added in v2.0.1)path
)// my-file.js
// if my-local-dependency.js has dependencies, it will include those too
const test = require("./my-local-dependency.js");
// ignored, is a built-in
const path = require("path");
const DependencyTree = require("@11ty/dependency-tree");
DependencyTree("./my-file.js");
// returns ["./my-local-dependency.js"]
allowNotFound
const DependencyTree = require("@11ty/dependency-tree");
DependencyTree("./this-does-not-exist.js"); // throws an error
DependencyTree("./this-does-not-exist.js", { allowNotFound: true });
// returns []
nodeModuleNames
(Added in v2.0.1) Controls whether or not node package names are included in the list of dependencies.
nodeModuleNames: "include"
: included alongside the local JS files.nodeModuleNames: "exclude"
(default): node module package names are excluded.nodeModuleNames: "only"
: only node module package names are returned.// my-file.js:
require("./my-local-dependency.js");
require("@11ty/eleventy");
const DependencyTree = require("@11ty/dependency-tree");
DependencyTree("./my-file.js");
// returns ["./my-local-dependency.js"]
DependencyTree("./my-file.js", { nodeModuleNames: "exclude" });
// returns ["./my-local-dependency.js"]
DependencyTree("./my-file.js", { nodeModuleNames: "include" });
// returns ["./my-local-dependency.js", "@11ty/eleventy"]
DependencyTree("./my-file.js", { nodeModuleNames: "only" });
// returns ["@11ty/eleventy"]
nodeModuleNamesOnly
(Added in v2.0.0) Changed to use nodeModuleNames
option instead. Backwards compatibility is maintained automatically.
nodeModuleNamesOnly: false
is mapped to nodeModuleNames: "exclude"
nodeModuleNamesOnly: true
is mapped to nodeModuleNames: "only"
If both nodeModuleNamesOnly
and nodeModuleNames
are included in options, nodeModuleNames
takes precedence.
v3.0.1
pnpm
#3FAQs
Finds all JavaScript CommmonJS require() dependencies from a filename.
We found that @11ty/dependency-tree demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.