
Security News
Feross on TBPN: Socket's Series C and the State of Software Supply Chain Security
Feross Aboukhadijeh joins TBPN to discuss Socket's $60M Series C, 500%+ ARR growth, AI's impact on open source, and the rise in supply chain attacks.
@purpleprivacy/tesseract-cli
Advanced tools
Tesseract – The Refactoring Compass: Analyze code complexity, cognitive load, and architectural health.
Tesseract helps you see where thinking gets hard in a TypeScript/JavaScript codebase.
Unlike linters (syntax/style) or generic code smells, Tesseract focuses on cognitive load, coupling, and architecture health using a project-wide import graph.
Status: MVP metrics & CLI are working (table output).
Next: JSON/PDF reports, dead code reachability, orphan exports, cycles, instability.
Runs a static analysis over your TS/JS project and reports per-file metrics:
if/for/while/switch/&&/||) aggregated per fileExample output:
npx tsx src/cli.ts ./src
┌───────────────────────────┬───────┬──────┬───────┬────────┬─────────┬───────┐
│ File │ Cyclo │ Nest │ FanIn │ FanOut │ Density │ Score │
├───────────────────────────┼───────┼──────┼───────┼────────┼─────────┼───────┤
│ ./src/cli.ts │ 0 │ 0 │ 0 │ 3 │ 2.94 │ 1 │
│ ./src/core/analyzer.ts │ 12 │ 0 │ 1 │ 5 │ 3.86 │ 6 │
│ ./src/core/metrics.ts │ 6 │ 0 │ 1 │ 0 │ 4.35 │ 3 │
│ ./src/core/parser.ts │ 1 │ 0 │ 1 │ 1 │ 2.83 │ 1 │
│ ./src/core/scorer.ts │ 1 │ 0 │ 1 │ 0 │ 4.00 │ 1 │
│ ./src/output/reporter.ts │ 5 │ 0 │ 1 │ 2 │ 3.46 │ 3 │
└───────────────────────────┴───────┴──────┴───────┴────────┴─────────┴───────┘
Positioning: a Refactoring Compass that guides legacy migrations and Clean Architecture / DDD alignment.
Requirements: Node 18+ (Node 20+ recommended), npm.
# install dependencies
npm install
# run analysis against your 'src' folder
npx tsx src/cli.ts ./src
By default, Tesseract scans recursively for .ts and .js files.
<path>: folder to analyze (e.g., ./src)Upcoming flags (next iteration):
--out <dir>: reports output directory (defaultreport/)--json <file>/--pdf <file>: override output paths--no-json/--no-pdf: disable a report type
| Metric | What it measures | Why it matters |
|---|---|---|
| Cyclomatic | Total decision points across functions | More paths → harder reasoning & testing |
| Nesting | Approx. average nested block depth | Indentation increases mental effort |
| Fan‑Out | Count of imports (local and third‑party, today) | Coupling & outward dependencies |
| Fan‑In | Count of files that import this file (local graph) | Indicates how many depend on you |
| Token Density | Tokens per line | Visual parsing difficulty |
| Score | Weighted composite (0–100) | Single “load” index for prioritization |
Risk Bands (Score):
Note: thresholds will be tuned with real‑world datasets.
import … from "<specifier>" statements in a file (currently includes third‑party and local).--local-only to restrict Fan‑Out to relative (.//../) imports.dep, dep.ts, dep.js, dep/index.ts, dep/index.js"react", "fs") are ignored for Fan‑In.src/
cli.ts # CLI entry
core/
parser.ts # ts-morph source loading & import collection
metrics.ts # metric computations
scorer.ts # composite score weighting
analyzer.ts # orchestrates parse → metrics → score
output/
reporter.ts # CLI table rendering
formatter.ts # risk bands, colors, benchmarks (extensible)
main yet — tracked in Next (see roadmap).report/cognitive-report.jsonreport/cognitive-report.pdfI = fanOut / (fanIn + fanOut) + outlier surfacing.tesseract.json: entry points, ignore globs, analysis depth, local‑only fan‑outpaths/baseUrl)Useful commands during development:
# run analysis against this repo
npx tsx src/cli.ts ./src
# typecheck
npx tsc --noEmit
Tech: TypeScript, ts‑morph, commander, cli‑table3.
PRs welcome! Please keep changes small and focused.
(CONTRIBUTING.md coming soon)
MIT — see LICENSE (to be added).
FAQs
Tesseract – The Refactoring Compass: Analyze code complexity, cognitive load, and architectural health.
The npm package @purpleprivacy/tesseract-cli receives a total of 38 weekly downloads. As such, @purpleprivacy/tesseract-cli popularity was classified as not popular.
We found that @purpleprivacy/tesseract-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Feross Aboukhadijeh joins TBPN to discuss Socket's $60M Series C, 500%+ ARR growth, AI's impact on open source, and the rise in supply chain attacks.

Security News
OSV withdrew 157 OSV malware reports after automated false positives incorrectly flagged trusted npm and PyPI packages, sending bad records into tools that rely on OSV data.

Research
/Security News
TrapDoor crypto stealer hits 36 malicious packages across npm, PyPI, and Crates.io, targeting crypto, DeFi, AI, and security developers.