
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
deadcode-detective
Advanced tools
A tool to detect dead code in JavaScript/TypeScript and Python projects
Unmask the silent clutter in your JavaScript, TypeScript, and Python projects.
Deadcode Detective is a sleek CLI tool that sniffs out unused code—those forgotten functions, variables, and exports lurking in your codebase. Powered by ts-prune for JS/TS and vulture for Python, it delivers a clear, colorful report to help you keep your projects lean and clean.
Dead code is a silent killer—slowing reviews, bloating builds, and hiding bugs. I’ve been there, untangling large codebases where cleanup was a nightmare. Deadcode Detective fixes that:
ts-prune and vulture into a single, polished CLI.Grab it from npm:
npm install -g deadcode-detective
ts-prune:npm install -g ts-prune
vulture:pip install vulture
Run the detect command with paths to scan:
deadcode-detective detect --py ./src/test/python --confidence 70
--js <path>: Scan JavaScript/TypeScript files.--py <path>: Scan Python files.--confidence <number>: Confidence threshold for Python dead code detection (0-100, default: 60). Throws an error if above 100 or below 0.--format <type>: Output format (cli, html, json, default: cli). Use html for web reports, json for machine-readable output, or cli for terminal output.--output <file>: Output file path (for html or json, defaults to console for json, file 'deadcode-report.' for html).Generate rich, shareable reports using --format and --output:
# HTML report (web view)
deadcode-detective detect --js ./src/test --py ./src/test/python --format html --output report.html
# JSON report (machine-readable)
deadcode-detective detect --js ./src/test --py ./src/test/python --format json --output report.json
The HTML report offers a visually appealing, interactive view with tabs for different languages and collapsible sections for files. Here’s a sample:

Click here to view the HTML report.
The JSON report provides a structured, machine-readable format for automation or CI/CD integration. Here’s an excerpt:
{
"js": [
{
"file": "src/test/js/unused.js",
"symbol": "unusedFunction",
"line": 2,
"language": "JS" }
],
"py": [
{
"file": "src/test/python/unused.py",
"symbol": "unused_function",
"line": 1,
"language": "Python",
"confidence": 60 }
],
"summary": {
"totalDeadCode": 2,
"timestamp": "Sun, 23 Feb 2025 18:15:28 UTC"
}
}
Click here to view the JSON report.
Below is the CLI structure which gets printed if no format is selected.
🔎 Dead Code Report:
❗ Found 2 unused items in JavaScript/TypeScript:
unused.js:
- unusedFunction (line 2)
dateFormatter.ts:
- formatDate (line 1)
❗ Found 1 unused item in Python:
script.py:
- dead_function (line 5)
If no dead code is found, you’ll see:
✅ No dead code found!
For JavaScript, a tsconfig.json is required for full accuracy. Plain JS support is limited but on the roadmap—stay tuned!
Clone the repo and test it on the included examples:
git clone https://github.com/yash9/deadcode-detective.git
cd deadcode-detective
npm install
npm run build
node dist/cli.js detect --js ./src/test/js --py ./src/test/python
The src/test/ folder contains sample JS and Python files with dead code to play with.
ts-prune to analyze your tsconfig.json-driven project.vulture with a 60% confidence threshold for reliable detection.Coming Soon: CI/CD integration, JSON/HTML reports, and more!
Love it? Hate it? Want to make it better? Contributions are welcome! 🚀
git checkout -b my-feature;
git commit -m "Add cool thing".
git push origin my-feature.
Check issues for ideas or report bugs.
This project is licensed under the MIT License © Yash.
See the LICENSE file for more details.
Found this useful? Give it a ⭐ on GitHub or share it with your crew. Let’s banish dead code together! If you’d like to support my work, consider buying me a coffee—every sip fuels more coding!
Questions? Hit me up in the issues
FAQs
A tool to detect dead code in JavaScript/TypeScript and Python projects
The npm package deadcode-detective receives a total of 4 weekly downloads. As such, deadcode-detective popularity was classified as not popular.
We found that deadcode-detective demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.