
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A comprehensive TypeScript dependency analysis tool that tracks the impact of code changes, including function calls and variable usage across your codebase
A TypeScript dependency analysis tool that tracks the impact of code changes. DepWalker analyzes Git changes and shows which functions are affected, along with their dependency chains.
DepWalker analyzes your TypeScript codebase in 4 steps:
┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ 1. Detect │ → │ 2. Parse │ → │ 3. Analyze │ → │ 4. Report │
│ Changes │ │ Code │ │ Dependencies│ │ Results │
└─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘
git diff to find files and line numbers you've modifiedPrerequisites: Node.js (v18+) and Git
Run without installing using your preferred package runner:
# npm
npx depwalker@latest
# pnpm
pnpm dlx depwalker@latest
# bun
bunx depwalker@latest
Run DepWalker in your TypeScript project with uncommitted changes:
# Basic usage - outputs Markdown report
npx depwalker@latest
# Interactive HTML visualization (auto-opens browser)
npx depwalker@latest --format html
# Using bunx instead of npx
bunx depwalker@latest --format html
# HTML with custom output path (auto-opens browser)
npx depwalker@latest --format html --output impact-report.html
# HTML without auto-opening browser
npx depwalker@latest --format html --no-open
# Limit analysis depth
npx depwalker@latest --depth 3
# Custom tsconfig location
npx depwalker@latest --tsconfig ./custom-tsconfig.json
# Save to file
npx depwalker@latest --output impact-report.md
# Impact Analysis
**2 files changed · 5 nodes**
🟠 1 high · 🟡 2 medium · 🟢 1 low · ⚪ 1 none
## Changed Nodes
| Node | File | Impact | Dependents | Depth |
| --------------- | -------------------------- | ------ | ---------- | ----- |
| **handleClick** | `src/components/Button.tsx:23` | 🟠 12 | 8 | 2 |
| **formatDate** | `src/utils/helpers.ts:10` | 🟡 6 | 4 | 1 |
## Test Targets
| Test Target | File | Depth | Covers |
| ----------- | ------------------------------- | -------- | -------------------- |
| `main` | `src/index.ts:1` | 1 level | `handleClick` |
| `App` | `src/App.tsx:5` | 3 levels | `handleClick` |
2 test targets
| Option | Description | Default |
|---|---|---|
-f, --format <format> | Output format: markdown, html | markdown |
-d, --depth <n> | Maximum analysis depth | No limit |
-t, --tsconfig <path> | TypeScript config path | ./tsconfig.json |
-o, --output <file> | Save report to file | Auto-generated |
--no-open | Don't auto-open HTML report in browser | (auto-opens) |
--no-open to disable).@ts-check)const fn = 'foo'; eval(fn)())import(\./${x}`)`) are not resolvedImpact Score = Dependents + (Depth × 3)
| Level | Score | Description |
|---|---|---|
| 🔴 Critical | 20+ | Extreme impact - changes ripple through many levels |
| 🟠 High | 10-19 | Significant impact |
| 🟡 Medium | 4-9 | Moderate impact |
| 🟢 Low | 1-3 | Minimal impact |
| ⚪ None | 0 | No external callers |
DepWalker uses a plugin-based architecture for output formats. Want to add JSON, CSV, or your own custom format? See CONTRIBUTING.md for a step-by-step guide to creating plugins.
git clone https://github.com/razrinn/depwalker.git
cd depwalker && pnpm install
git checkout -b feature/my-feature
# Make changes
pnpm changeset # Add changeset
pnpm build # Test build
git commit -m "feat: description"
git push origin feature/my-feature
# Create PR
| Step | Who | Action |
|---|---|---|
| 1 | Contributor | Add changeset + PR |
| 2 | Maintainer | Merge PR |
| 3 | CI | Create "Version Packages" PR |
| 4 | Maintainer | Merge "Version Packages" PR |
| 5 | CI | Auto-publish to npm + create tag ✅ |
See CONTRIBUTING.md and RELEASE.md for details.
ISC License - see LICENSE
Made with ❤️ by Ray Azrin Karim
FAQs
A comprehensive TypeScript dependency analysis tool that tracks the impact of code changes, including function calls and variable usage across your codebase
The npm package depwalker receives a total of 21 weekly downloads. As such, depwalker popularity was classified as not popular.
We found that depwalker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.