
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@deplens/core
Advanced tools
Programmatic API for inspecting installed packages: runtime exports, parsed type signatures, and JSDoc.
npm i @deplens/core
import { runInspect, runDiff } from '@deplens/core';
const output = await runInspect({
target: 'ai',
showTypes: true,
filter: 'generate',
resolveFrom: process.cwd(),
});
console.log(output);
const diff = await runDiff({
package: 'express',
from: '4.18.0',
to: '4.19.0',
format: 'json',
});
console.log(diff.output);
runInspect returns a string when no custom writers are provided. If you pass write or writeError, it will stream to those instead.
target (string, required): package name or import path (e.g. react, next/server)filter (string): substring filter for export namesshowTypes (boolean): include type signatures from .d.tskind (string[]): filter by export kind (function, class, object, constant)runtime (boolean): import the package entrypoint for runtime exports; set false for static type/package inspectionanalyzeSource (boolean): include source complexity and implementation summariesdepth (number): object inspection depth (0–5)resolveFrom (string): base directory for module resolutioncwd (string): working directory for the inspectionwrite (function): output sink (defaults to collecting and returning a string)writeError (function): error output sinkJSDoc options:
jsdoc (string): off | compact | fulljsdocOutput (string): off | section | inline | onlyjsdocQuery (object):
symbols: string or string[]sections: summary | params | returns | tagstags.include / tags.exclude: string[]mode: compact | fullmaxLen: numbertruncate: none | sentence | wordExample: JSDoc focused on params/returns
await runInspect({
target: 'ai',
showTypes: true,
jsdocOutput: 'section',
jsdocQuery: {
symbols: 'generateText',
sections: ['params', 'returns'],
tags: { include: ['param', 'returns'] },
mode: 'compact',
truncate: 'sentence',
maxLen: 220,
},
});
jsdocOutput: 'only' returns a focused jsdoc.entries projection in object/JSON mode
and renders the same entries in text mode. Plain jsdocQuery.symbols values match exact
export names; use * or /regex/ for broader matching.
Compact projections keep staticExports to a count unless explicitly selected, summarize
source analysis, and omit symbol inventories for focused docs/examples/JSDoc requests.
project-diff returns direct dependency changes by default; set includeTransitive: true
for the complete lockfile graph. pnpm peer suffixes are stripped before versions are compared.
.d.ts declarations, not runtime JS.--resolve-from is essential in monorepos to avoid false negatives.MIT
FAQs
Core engine for inspecting installed package exports and types
The npm package @deplens/core receives a total of 18 weekly downloads. As such, @deplens/core popularity was classified as not popular.
We found that @deplens/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.