depscope

DepScope

Your package.json has 47 dependencies. How many are abandoned?

DepScope is a zero-config CLI that scans your npm dependencies and gives each one a health score based on maintenance activity, download trends, bundle size, and known vulnerabilities. Find the dead weight before it finds you.

npx depscope

What It Checks

DepScope evaluates every dependency across 5 dimensions:

Dimension	What it measures
Maintenance	When was the last publish? Active, stale, or abandoned?
Popularity	Weekly download count and trend direction
Size	Unpacked size — catch the bloat before it ships
Security	Known CVEs and vulnerability severity
Trend	Is usage growing, stable, or declining?

Each dependency gets a 0-100 health score and a letter grade.

Example Output

  DepScope — Dependency Health Report
  ──────────────────────────────────────────────────────

  Production Dependencies (6)

  A express                       ^4.21.0 → 4.21.0
    ████████████████████░░░░ 85/100  active  28,000,000/wk ↑  209 KB  ✓ secure

  A fastify                       ^5.2.1 → 5.2.1
    ██████████████████████░░ 92/100  active  4,200,000/wk ↑  312 KB  ✓ secure

  B lodash                        ^4.17.21 → 4.17.21
    ████████████████░░░░░░░░ 68/100  stale   51,000,000/wk →  1.4 MB  ✓ secure

  C moment                        ^2.30.1 → 2.30.1
    ██████████░░░░░░░░░░░░░░ 42/100  abandoned  12,500,000/wk ↓  4.2 MB  ✓ secure
    ↳ Consider: dayjs — 2KB, same API, actively maintained

  D request                       ^2.88.2 → 2.88.2
    ██████░░░░░░░░░░░░░░░░░░ 22/100  abandoned  5,800,000/wk ↓  1.1 MB  ✗ 3 vulns (high)
    ↳ Consider: undici — Built into Node.js, modern HTTP client

  F event-stream                  ^4.0.1 → 4.0.1
    ██░░░░░░░░░░░░░░░░░░░░░░ 8/100   abandoned  320,000/wk ↓  45 KB  ✗ 1 vuln (critical)

  ──────────────────────────────────────────────────────

  Project Health: B  ████████████████░░░░░░░░ 64/100

  Grades: A:2  B:1  C:1  D:1  F:1
  Total: 6 dependencies
  ⚠ 3 abandoned packages
  ⚠ 2 packages with known vulnerabilities
  ✓ 3 healthy packages (A or B)

Health Score

Each dependency is scored on a 100-point scale:

Dimension	Weight	Scoring
Maintenance	30pts	active=30, stale=15, abandoned=0
Popularity	20pts	>1M/wk=20, >100K=15, >10K=10, >1K=5, else=0
Size	15pts	<100KB=15, <500KB=12, <1MB=8, <5MB=4, else=0
Security	25pts	clean=25, low=15, moderate=8, high=2, critical=0
Trend	10pts	growing=10, stable=7, declining=2

Grades

Grade	Score	Meaning
A	80-100	Healthy — well-maintained, popular, secure
B	60-79	Good — minor concerns, generally fine
C	40-59	Fair — some red flags, review recommended
D	20-39	Poor — significant issues, consider replacing
F	0-19	Critical — abandoned, vulnerable, or both

CLI Reference

depscope [path] [options]

Arguments

Argument	Description	Default
path	Path to project directory	Current directory

Options

Flag	Description
--json	Output results as JSON (for CI/CD piping)
--dev	Include devDependencies in analysis
--fix	Show alternative package suggestions
--no-cache	Skip cache, make fresh API calls
--quiet	Minimal output — just score and issues
--limit <n>	Only show the N worst-scoring dependencies
-v, --version	Show version number
-h, --help	Show help

Examples

# Scan current project
npx depscope

# Scan a specific project
npx depscope ./my-project

# JSON output for CI
npx depscope --json

# Show everything including dev dependencies
npx depscope --dev

# Find the 5 worst dependencies with fix suggestions
npx depscope --fix --limit 5

# Quick health check
depscope --quiet

CI/CD Integration

DepScope exits with code 1 if any dependency has an F grade, making it easy to integrate into CI pipelines:

# GitHub Actions
- name: Check dependency health
  run: npx depscope --json > depscope-report.json

# Parse with jq
npx depscope --json | jq '.dependencies[] | select(.grade == "F") | .name'

Alternatives Database

When you use the --fix flag, DepScope suggests modern alternatives for problematic packages. The curated database covers common migrations like:

• moment -> dayjs (2KB, same API)
• request -> undici (built into Node.js)
• lodash -> native ES6+ methods
• chalk -> built-in ANSI codes
• And many more

Requirements

• Node.js 18 or later (uses built-in fetch())
• A package.json file to scan

Related Tools

• RulesForge — Using AI coding tools? Generate better rules for Cursor, Copilot, and Claude Code.
• ScopeGuard — Prevent AI scope creep with automated boundary enforcement.

License

MIT - Copyright 2026 Wittlesus