devcompass
Advanced tools
Dependency health checker with ecosystem intelligence, unified interactive dashboard with 5 dynamic layouts (Tree/Force/Radial/Conflict/Analytics), historical tracking with SQLite, snapshot comparison, timeline visualization, modular CSS/JS architecture,
AI-powered dependency health checker with 10 complete CLI commands featuring CVE vulnerability detection, interactive graph visualization, snapshot management, backup system, unified dashboard with 5 dynamic layouts (Tree/Force/Radial/Conflict/Analytics), intelligent AI recommendations, multi-provider LLM support, historical tracking with SQLite database, snapshot comparison, timeline visualization, modular CSS/JS architecture, intelligent clustering (Ecosystem/Health/Depth grouping), real-time filtering, advanced zoom controls, theme support (dark/light), supply chain security with auto-fix, license conflict resolution, package quality auto-fix, batch fix modes, and professional dependency exploration.
Analyze your JavaScript projects to find unused dependencies, outdated packages, detect CVE vulnerabilities with OSV + NVD, visualize dependency graphs with interactive controls, manage snapshots of your project state, compare changes over time, backup and restore package files, get AI-powered recommendations, ask questions about your dependencies, find package alternatives with AI, chat with AI about your project, monitor GitHub issues in real-time for 502 packages, configure your own GitHub token to avoid rate limits, customize all configuration via JSON files, organize packages by ecosystem (React/Vue/Angular/Testing/Build Tools), group by health status (Critical/Warning/Healthy), analyze by depth levels, instant layout switching, dark/light theme toggle, real-time filtering, advanced zoom controls, track dependency changes over time with SQLite database, visualize evolution with interactive timelines, check bundle sizes, verify licenses, detect and auto-fix supply chain attacks, resolve license conflicts automatically, replace abandoned/deprecated packages automatically, analyze package quality, batch fix with granular control, and automatically fix issues with dry-run, progress tracking, and backups. Perfect for CI/CD pipelines with JSON output and exit codes.
🛡️ LATEST v3.2.4: CVE Vulnerability Detection - Real-time security scanning with OSV + NVD! 🛡️
🎯 v3.2.3: Feature Complete - All 10 commands now working! Graph, Snapshot, Compare, Backup! 🎯
🤖 v3.2.2: AI-Powered Analysis - Get intelligent recommendations from OpenAI, Anthropic, Google, or FREE local AI! 🤖
🛡️ CVE Vulnerability Detection - Industry-Standard Security Scanning!
DevCompass now integrates with industry-standard vulnerability databases to detect security issues in real-time!
Key Features:
🔍 OSV API Integration (Primary Source - No Key Required)
🏛️ NVD API Integration (Secondary Enrichment - Optional Key)
⚡ Intelligent Caching System
🔒 Encrypted API Key Storage
CVE Commands:
# Configure NVD API key (optional but recommended)
devcompass cve key --set --api-key <your-key>
devcompass cve test # Test connection
devcompass cve key # Show status
# Cache management
devcompass cve cache --stats # View statistics
devcompass cve cache --clear # Clear cache
# Analysis includes CVE detection automatically
devcompass analyze # CVE scan included!
Getting NVD API Key:
devcompass cve key --set --api-key <key>analyze run checks for CVEs🛡️ CVE VULNERABILITY DATABASE (4)
🟡 MEDIUM: 12
Affected Packages:
axios@0.21.1
● GHSA-3p68-rc4w-qgx5 - MEDIUM
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
● GHSA-43fc-jf86-j433 - MEDIUM
Axios Denial of Service vulnerability
express@4.17.1
● GHSA-qw6h-vgh9-j6wx - MEDIUM
Express.js Open Redirect in malformed URLs
💡 Sources: OSV (Open Source Vulnerabilities) + NVD (National Vulnerability Database)
Run npm audit fix to fix known vulnerabilities
# Global (recommended)
npm install -g devcompass@3.2.4
# Local
npm install --save-dev devcompass@3.2.4
# One-time use
npx devcompass@3.2.4 analyze
# Upgrade from any version
npm install -g devcompass@3.2.4
# Configure GitHub token (recommended)
devcompass config --github-token <your-token>
devcompass config --show
# Analyze project (includes CVE detection!)
devcompass analyze
devcompass analyze --ai # 🤖 With AI recommendations!
devcompass analyze --no-history # Skip snapshot
# Generate interactive graph
devcompass graph --open
devcompass graph --layout force --filter vulnerable
# Auto-fix issues
devcompass fix
devcompass fix --batch
devcompass fix --dry-run
# Configure NVD API key (optional)
devcompass cve key --set --api-key <your-nvd-key>
devcompass cve key # Show current status
devcompass cve key --remove # Remove stored key
# Test NVD API connection
devcompass cve test # Validate your key
# Cache management
devcompass cve cache --stats # View cache statistics
devcompass cve cache --clear # Clear vulnerability cache
# CVE detection runs automatically with analyze
devcompass analyze # Includes CVE scan!
Getting Your NVD API Key:
# 1. Visit: https://nvd.nist.gov/developers/request-an-api-key
# 2. Fill in:
# - Email address
# - Organization name
# - Agree to Terms of Use
# 3. Check your email for single-use activation link
# 4. Click link to activate (must activate within 7 days)
# 5. Copy your API key from the confirmation page
# 6. Add to DevCompass:
devcompass cve key --set --api-key 9d47e8fb-0837-4da7-a1cf-7a0bxxx8ca22
# 7. Test it:
devcompass cve test
# Output:
# 🧪 Testing NVD API Key...
# ✓ NVD API key is valid ✓
# Generate interactive dependency graph
devcompass graph # Default tree layout
devcompass graph --layout force # Force-directed layout
devcompass graph --layout radial # Radial tree layout
devcompass graph --layout conflict # Highlight conflicts
# Apply filters
devcompass graph --filter vulnerable # Show only vulnerable
devcompass graph --filter outdated # Show only outdated
devcompass graph --filter unused # Show only unused
# Customize output
devcompass graph --output my-graph.html # Custom filename
devcompass graph --width 1600 --height 900 # Custom dimensions
devcompass graph --depth 5 # Limit depth to 5 levels
devcompass graph --open # Open in browser
# Export formats
devcompass graph --format json # Export as JSON
devcompass graph --format html # Export as HTML (default)
# Save current state
devcompass snapshot save
# List all snapshots
devcompass snapshot list # Last 20 snapshots
devcompass snapshot list --limit 50 # Last 50 snapshots
devcompass snapshot list --project myapp # Filter by project
# View snapshot details
devcompass snapshot view 123 # Basic info
devcompass snapshot view 123 --verbose # Detailed info
# Delete old snapshots
devcompass snapshot delete 123 # With confirmation
devcompass snapshot delete 123 --yes # Skip confirmation
# Compare two snapshots
devcompass compare 51 52 # Basic comparison
devcompass compare 51 52 --verbose # Show all packages
devcompass compare 51 52 -o report.md # Save to file
# List all backups
devcompass backup list
# Show backup details
devcompass backup info --name backup-2026-04-26T19-50-37-541Z
# Restore from backup
devcompass backup restore --name backup-2026-04-26T19-50-37-541Z
devcompass backup restore --name backup-xxx --force # Skip confirmation
# Clean old backups
devcompass backup clean # Keep latest 5
devcompass backup clean --keep 3 # Keep latest 3
# Setup AI provider
devcompass llm add --provider openai --token sk-xxx --model gpt-4o-mini
devcompass llm add --provider local --model llama3.2 --base-url http://localhost:11434
# AI Analysis
devcompass analyze --ai
devcompass ai ask "Why is my health score low?"
devcompass ai alternatives moment
devcompass ai chat
devcompass llm stats
# List snapshots (also available via 'snapshot list')
devcompass history list
devcompass history list --month 04-2026
# Compare snapshots (also available via 'compare')
devcompass compare 5 8
# Timeline visualization
devcompass timeline --open
devcompass timeline --days 60
Automatic Detection:
Every time you run devcompass analyze, the tool automatically:
Data Sources:
Severity Classification:
Performance:
Security & Privacy:
$ devcompass analyze
🔍 DevCompass v3.2.4 - Analyzing your project...
✔ Scanned 6 dependencies in project
⚡ GitHub check completed in 4.76s
📦 CVE check completed (6/6 from cache)
🔴 CVE VULNERABILITIES DETECTED (4 packages)
🟡 MEDIUM: 12
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🛡️ CVE VULNERABILITY DATABASE (4)
🟡 MEDIUM: 12
Affected Packages:
axios@0.21.1
● GHSA-3p68-rc4w-qgx5 - MEDIUM
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
● GHSA-43fc-jf86-j433 - MEDIUM
Axios Denial of Service vulnerability
express@4.17.1
● GHSA-qw6h-vgh9-j6wx - MEDIUM
Express.js Open Redirect in malformed URLs
● GHSA-rv95-896h-c2vc - MEDIUM
Express.js path traversal vulnerability
lodash@4.17.21
● GHSA-f23m-r3pf-42rh - MEDIUM
Prototype pollution in lodash
● GHSA-r5fr-rjxr-66jc - MEDIUM
Command injection in lodash templates
request@2.88.2
● GHSA-p8p7-x288-28g6 - MEDIUM
Server-Side Request Forgery in request
💡 Sources: OSV (Open Source Vulnerabilities) + NVD (National Vulnerability Database)
Run npm audit fix to fix known vulnerabilities
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
# View cache statistics
$ devcompass cve cache --stats
📊 CVE Cache Statistics
Total entries: 14
Active: 14
Expired: 0
Outdated: 0
# Clear cache (force fresh scan)
$ devcompass cve cache --clear
✓ Cleared 14 cached CVE entries
# Show current status
$ devcompass cve key
🔑 NVD API Key Status
✓ Configured
Key: 9d47e8f***ca22
💡 Commands:
Test: devcompass cve test
Remove: devcompass cve key --remove
# Test your API key
$ devcompass cve test
🧪 Testing NVD API Key...
✓ NVD API key is valid ✓
Ready to use:
Run: devcompass analyze to scan with CVE detection
# Remove API key
$ devcompass cve key --remove
✓ NVD API key removed
| Operation | Without Cache | With Cache | Improvement |
|---|---|---|---|
| Scan 6 packages | ~2-5s | <100ms | 20-50× faster |
| CVE lookup | 300-500ms | <10ms | 30-50× faster |
| Full analysis | ~8-12s | ~5-6s | 40-50% faster |
Database Schema:
-- Encrypted API keys
api_keys (id, service, api_key, is_active, created_at)
-- Cached vulnerability data
vulnerability_cache (
id, package_name, package_version,
vulnerabilities, cache_version,
cached_at, expires_at
)
-- Cache metadata
cache_metadata (key, value)
Encryption:
Cache Version Management:
Multiple Layouts:
Real-Time Filtering:
Interactive Controls:
# Generate graph and open in browser
devcompass graph --open
# Force-directed layout showing only vulnerabilities
devcompass graph --layout force --filter vulnerable --open
# Custom output with depth limit
devcompass graph --output deps.html --depth 3 --open
📊 DevCompass - Dependency Graph
✔ Generated graph with 86 nodes (4 with issues)
✔ Graph exported: dependency-graph.html
📈 GRAPH SUMMARY
Format: HTML
Mode: ✓ Unified Interactive
Layouts: Tree, Force, Radial, Conflict (switchable)
Filters: All, Vulnerable, Outdated, Unused, Deprecated (switchable)
Total Nodes: 86
Total Links: 163
File Size: 144.68 KB
Enriched: ✓ Analysis data applied
Save Snapshots:
List Snapshots:
View Details:
# Save current state
$ devcompass snapshot save
📸 Saving Snapshot...
✅ Snapshot saved successfully!
📸 Snapshot Info:
ID: 71
Packages: 6
Dependencies: 163
Duration: 12ms
# List all snapshots
$ devcompass snapshot list
📋 Dependency Snapshots
ID Project Version Health Deps Date
──────────────────────────────────────────────────────────────
71 test-project 1.0.0 0.5 6 2026-05-01 1:45:23 PM
70 test-project 1.0.0 0.5 6 2026-04-30 7:37:27 AM
69 devcompass 3.2.4 7.5 7 2026-04-30 6:02:45 AM
Total: 20 snapshot(s)
# View details
$ devcompass snapshot view 71
📸 Snapshot #71
Project Information:
Name: test-project
Version: 1.0.0
Date: 2026-05-01 1:45:23 PM
Health Metrics:
Health Score: 0.5/10
Total Dependencies: 6
CVE Vulnerabilities: 12 (MEDIUM)
Package Summary:
🔴 Vulnerable: 4
📦 Outdated: 6
🗑️ Unused: 2
Compare Snapshots:
# Compare two snapshots
$ devcompass compare 69 71
✔ Comparison complete (0ms)
📊 Snapshot Comparison
Snapshots:
#69 → #71
2026-04-30 06:02:45 → 2026-05-01 13:45:23
Changes:
Total Packages: 7 → 6 (-1)
Health Score: 7.50 → 0.50 (-7.00) ❌
CVE Vulnerabilities: 0 → 12 (+12) 🔴
Added: 0
Removed: 1
Updated: 3
Unchanged: 3
🗑️ Removed Packages (1):
- better-sqlite3 (11.14.0)
🔄 Updated Packages (3):
⟳ axios
Version: 0.27.2 → 0.21.1
Health: 9.0 → 6.2 (-2.8)
🔴 New vulnerabilities detected: 2 MEDIUM CVEs
⟳ chalk
Version: 5.4.2 → 4.1.2
Health: 10.0 → 8.5 (-1.5)
⟳ lodash
Version: 4.17.21 → 4.17.20
Health: 9.0 → 7.0 (-2.0)
🔴 New vulnerabilities detected: 2 MEDIUM CVEs
Backup Operations:
# List all backups
$ devcompass backup list
💾 DevCompass Backups
Found 3 backup(s):
1. backup-2026-04-26T19-50-37-541Z
Created: Apr 27, 2026 01:20:37 (3 days ago)
Files: package.json, package-lock.json
Reason: Before automated fixes
Fixes pending: 3
Health score: 0.5/10
2. backup-2026-04-26T18-12-33-397Z
Created: Apr 26, 2026 23:42:33 (3 days ago)
Files: package.json, package-lock.json
Reason: Before automated fixes
Fixes pending: 3
Health score: 0.5/10
💡 COMMANDS:
Restore: devcompass backup restore --name backup-2026-04-26T19-50-37-541Z
Info: devcompass backup info --name backup-2026-04-26T19-50-37-541Z
Clean: devcompass backup clean
# Restore from backup
$ devcompass backup restore --name backup-2026-04-26T19-50-37-541Z
🔄 DevCompass Backup Restore
Backup details:
Name: backup-2026-04-26T19-50-37-541Z
Created: Apr 27, 2026 01:20:37
Files: package.json, package-lock.json
⚠️ WARNING: This will overwrite your current package.json and package-lock.json
Continue with restore? (y/N): y
Step 1: Creating backup of current state...
✓ Current state backed up: backup-2026-05-01T13-50-15-123Z
Step 2: Restoring from backup...
✓ Backup restored successfully!
Files restored:
✓ package.json
✓ package-lock.json
⚠️ IMPORTANT: Run npm install to sync node_modules
1. Install Ollama (FREE local AI):
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
# Start Ollama
ollama serve
# Pull a model
ollama pull llama3.2
# Add to DevCompass
devcompass llm add --provider local --model llama3.2 --base-url http://localhost:11434
# Test it
devcompass llm test local
# Use it!
devcompass analyze --ai
2. Or use OpenAI:
# Get API key from: https://platform.openai.com/api-keys
# Add provider
devcompass llm add --provider openai --token sk-your-key --model gpt-4o-mini
# Test connection
devcompass llm test openai
# Use it!
devcompass analyze --ai
Get Analysis:
$ devcompass analyze --ai
🤖 AI Recommendations
🔴 CRITICAL (Do Now):
- Security Vulnerabilities (12 CVEs detected)
→ Run: npm audit fix
→ Why: MEDIUM severity issues in axios, express, lodash
🟡 HIGH PRIORITY (This Week):
- Update axios (0.21.1 → 1.15.2)
→ Why: Contains 2 known CVEs (GHSA-3p68-rc4w-qgx5, GHSA-43fc-jf86-j433)
→ Breaking changes: Response format changed
Ask Questions:
$ devcompass ai ask "Should I update axios from 0.21.1 to 1.15.2?"
🤖 Yes, you should update axios:
Security: Version 0.21.1 has 2 MEDIUM CVEs detected:
- GHSA-3p68-rc4w-qgx5: NO_PROXY Hostname Normalization Bypass
- GHSA-43fc-jf86-j433: Denial of Service vulnerability
Breaking Changes: Response.data format changed, error handling updated
Migration: Update interceptors, test error handling
Command: npm install axios@latest
Test thoroughly before deploying!
Find Alternatives:
$ devcompass ai alternatives moment
🔍 Finding alternatives for "moment"
🤖 Top 3 Alternatives:
1. date-fns (~2KB vs 67KB)
- Tree-shakeable, modern API
- Migration: Easy (similar methods)
2. dayjs (~2KB)
- moment.js compatible API
- Migration: Drop-in replacement
3. Luxon (~15KB)
- Better timezone support
- Migration: Medium (different API)
Recommendation: Use date-fns for best bundle size
Track your dependency evolution over time with automatic snapshots, comparison tools, and timeline visualization.
1. Auto-Save on Analyze
Every time you run devcompass analyze, a snapshot is automatically saved:
devcompass analyze
# Output:
# ✔ Scanned 6 dependencies in project
# 📸 Snapshot saved (ID: 40, 19ms)
# Use "devcompass history list" to view all snapshots
2. View Your History
devcompass history list
# Or use the new snapshot command:
devcompass snapshot list
3. Compare Changes
devcompass compare 38 40
4. Visualize Trends
devcompass timeline --open
"CVE detection not working"
# Make sure you ran analyze first
devcompass analyze
# Check if CVE database exists
ls ~/.devcompass/cve.db
# Clear cache and try again
devcompass cve cache --clear
devcompass analyze
"NVD API key invalid"
# Test your API key
devcompass cve test
# If invalid, get a new key from:
# https://nvd.nist.gov/developers/request-an-api-key
# Remove old key and add new one
devcompass cve key --remove
devcompass cve key --set --api-key <new-key>
"All CVEs showing as UNKNOWN severity"
# This is a cache issue - clear it
devcompass cve cache --clear
# Run fresh scan
devcompass analyze
"CVE scan too slow"
# First run is always slower (2-5s for API calls)
# Subsequent runs use cache (<100ms)
# Check cache status
devcompass cve cache --stats
# If cache expired, it will re-fetch
# Cache TTL is 24 hours
"No analysis cache found"
# Run analyze first to generate cache
devcompass analyze
# Then generate graph
devcompass graph --open
"Graph not opening in browser"
# Check if HTML file was created
ls dependency-graph.html
# Manually open it
firefox dependency-graph.html
# or
chrome dependency-graph.html
"Snapshot list empty"
# Run analyze to create snapshots
devcompass analyze
# Check database exists
ls ~/.devcompass/history.db
# List snapshots
devcompass snapshot list
"Snapshot not found"
# List available snapshots first
devcompass snapshot list
# Use valid ID from list
devcompass snapshot view 70
"Backup list empty"
# Backups are created by fix command
devcompass fix --dry-run
# Check backup directory
ls -la .devcompass-backups/
"Cannot restore backup"
# List available backups
devcompass backup list
# Use exact backup name
devcompass backup restore --name backup-2026-04-26T19-50-37-541Z
"No AI provider configured"
# Add a provider first
devcompass llm add --provider local --model llama3.2 --base-url http://localhost:11434
# Or use OpenAI
devcompass llm add --provider openai --token sk-xxx --model gpt-4o-mini
"Ollama connection failed"
# Check Ollama is running
ps aux | grep ollama
# Restart Ollama
ollama serve &
# Test connection
devcompass llm test local
"Command not found"
npm install -g devcompass@3.2.4
Old version
npm update -g devcompass
devcompass --version # Should show 3.2.4
Contributions welcome!
Add Package Alternatives
data/quality-alternatives.jsonImprove AI Prompts
src/ai/prompt-templates.jsAdd AI Providers
src/ai/providers/Improve Graph Layouts
src/dashboard/scripts/layouts.jsEnhance CVE Detection
src/cve/osv-client.jsCode Contributions
git checkout -b feature/amazing)git commit -m 'Add feature')git push origin feature/amazing)MIT © Ajay Thorat
Want to contribute? Pick a feature and open an issue! 🚀
Made with ❤️ by Ajay Thorat
DevCompass v3.2.4 - Complete Dependency Intelligence + Security Platform! 🧭✨
Like Lighthouse for your dependencies, now with real-time CVE detection 🛡️⚡
FAQs
Dependency health checker with ecosystem intelligence, unified interactive dashboard with 5 dynamic layouts (Tree/Force/Radial/Conflict/Analytics), historical tracking with SQLite, snapshot comparison, timeline visualization, modular CSS/JS architecture,
The npm package devcompass receives a total of 94 weekly downloads. As such, devcompass popularity was classified as not popular.
We found that devcompass demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.
Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.