
Security News
Open VSX Begins Implementing Pre-Publish Security Checks After Repeated Supply Chain Incidents
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.
deps-walker
Advanced tools
Graph traversal to walk through ES6/ES2015 module dependency graph for further static analysis. The traversal algorithm is classified as Breadth-first search (BFS).
$ npm install deps-walker
Here is an example of an entry point module entry.js with its dependencies, which in turn depend on their dependencies, which in turn depend on...
//------ entry.js ------
import a from './a.js';
import b from './b.js';
//------ a.js ------
import b from './b.js';
import c from './c.js';
import d from './d.js';
//------ c.js ------
import d from './d.js';
//------ d.js ------
import b from './b.js';
In other words:
entry.js -> a.js
entry.js -> b.js
a.js -> b.js
a.js -> c.js
a.js -> d.js
c.js -> d.js
d.js -> b.js
deps-walker is used to traverse entry.js dependency graph:
const walk = require('deps-walker')();
walk('entry.js', (err, data) => {
if (err) {
// catch any errors...
return;
}
const { filePath, dependencies } = data;
// analyse module dependencies
});
The dependencies are traversed in the following order:
deps-walker support async/await API, it can be used to await traverse completion:
async function traverse() {
await walk('entry.js', (err, data) => {/*...*/});
console.log('Traverse is completed');
}
deps-walker supports multiple roots:
walk(['entry1.js', 'entry2.js', 'entry3.js'], (err, data) => {/*...*/});
deps-walker uses babylon parser with sourceType: module option by default, but you can customize any of default options:
const babylonParse = require('deps-walker/lib/parsers/babylon');
const walk = require('deps-walker')({
parse: (...args) =>
babylonParse(...args, {
// options
sourceType: module,
plugins: ['jsx', 'flow']
})
});
or specify your own parse implementation:
const walk = require('deps-walker')({
parse: (code, filePath) => {
// parse implementation
}
});
It is not always obvious where import x from 'module' should look to find the file behind module, it depends on module resolution algorithms, which are specific for module bundlers, module syntax specs, etc.. deps-walker uses resolve package, which implements NodeJS module resolution behavior. You may configure NodeJS resolve via available options:
const nodejsResolve = require('deps-walker/lib/resolvers/nodejs');
const walk = require('deps-walker')({
resolve: (...args) =>
nodejsResolve(...args, {
// options
extensions: [ '.js' ]
paths: ['rootDir'],
moduleDirectory: 'node_modules'
})
});
You can also use other module resolution algorithms:
const walk = require('deps-walker')({
resolve: (filePath, contextPath) => {
// resolve implementation
}
});
You may break traversal for some dependencies by specifying ignore function:
const walk = require('deps-walker')({
// ignore node_modules
ignore: (filePath) => /node_modules/.test(filePath)
});
Module parsing and resolving can be resource intensive operation (CPU, I/O), cache allows to speed up traversal re-run:
const cache = require('deps-walker/cache');
const walk = require('deps-walker')({ cache });
//...
await cache.load('./cache.json');
await walk('entry.js', (err, data) => {/*...*/});
await cache.save('./cache.json');
FAQs
Walks the module dependency graph. It's highly configurable.
The npm package deps-walker receives a total of 1 weekly downloads. As such, deps-walker popularity was classified as not popular.
We found that deps-walker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.

Research
/Security News
Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.

Security News
Lodash 4.17.23 marks a security reset, with maintainers rebuilding governance and infrastructure to support long-term, sustainable maintenance.