Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The dpdm (Dependency Path Dependency Manager) npm package is a tool for analyzing and managing dependencies in JavaScript and TypeScript projects. It helps developers understand the structure of their dependencies, identify circular dependencies, and visualize the dependency graph.
Analyze Dependencies
This feature allows you to analyze the dependencies of your project starting from a given entry point. The result will include information about all the modules and their dependencies.
const dpdm = require('dpdm');
const result = dpdm({ entryPoints: ['./src/index.js'] });
console.log(result);
Detect Circular Dependencies
This feature helps you detect circular dependencies in your project. By setting the `detectCircular` option to true, the result will include information about any circular dependencies found.
const dpdm = require('dpdm');
const result = dpdm({ entryPoints: ['./src/index.js'], detectCircular: true });
console.log(result.circular);
Visualize Dependency Graph
This feature allows you to visualize the dependency graph of your project. By setting the `output` option to 'graph', the result will include a representation of the dependency graph.
const dpdm = require('dpdm');
const result = dpdm({ entryPoints: ['./src/index.js'], output: 'graph' });
console.log(result.graph);
Madge is a JavaScript library that provides similar functionality to dpdm, including dependency analysis, circular dependency detection, and visualization of dependency graphs. It is known for its ease of use and powerful visualization capabilities.
Depcheck is a tool that helps you find unused dependencies in your project. While it does not provide visualization or circular dependency detection, it is useful for cleaning up your project's dependencies.
Dependency-cruiser is a tool for validating and visualizing dependencies in JavaScript and TypeScript projects. It offers extensive configuration options and supports various output formats, making it a versatile alternative to dpdm.
A robust static dependency analyzer for your JavaScript
and TypeScript
projects.
Highlights | Install | Usage | Options | API
CommonJS
, ESM
.JavaScript
and TypeScript
completely.
madge
, whose results are completely inconclusive when analyze TypeScript
.For command line
npm i -g dpdm
# or via yarn
yarn global add dpdm
As a module
npm i -D dpdm
# or via yarn
yarn add -D dpdm
Simple usage
dpdm ./src/index.ts
Print circular dependencies only
dpdm --no-warning --no-tree ./src/index.ts
Exit with a non-zero code if a circular dependency is found.
dpdm --exit-code circular:1 ./src/index.ts
Ignore type dependencies for TypeScript modules
dpdm -T ./src/index.ts
Find unused files by index.js
in src
directory:
dpdm --no-tree --no-warning --no-circular --detect-unused-files-from 'src/**/*.*' 'index.js'
Skip dynamic imports:
# The value circular will only ignore the dynamic imports
# when parse circular references.
# You can set it as tree to ignore the dynamic imports
# when parse source files.
dpdm --skip-dynamic-imports circular index.js
dpdm [options] <files...>
Analyze the files' dependencies.
Positionals:
files The file paths or globs [string]
Options:
--version Show version number [boolean]
--context the context directory to shorten path, default is current
directory [string]
--extensions, --ext comma separated extensions to resolve
[string] [default: ".ts,.tsx,.mjs,.js,.jsx,.json"]
--js comma separated extensions indicate the file is js like
[string] [default: ".ts,.tsx,.mjs,.js,.jsx"]
--include included filenames regexp in string, default includes all files
[string] [default: ".*"]
--exclude excluded filenames regexp in string, set as empty string to
include all files [string] [default: "node_modules"]
-o, --output output json to file [string]
--tree print tree to stdout [boolean] [default: true]
--circular print circular to stdout [boolean] [default: true]
--warning print warning to stdout [boolean] [default: true]
--tsconfig the tsconfig path, which is used for resolve path alias, default
is tsconfig.json if it exists in context directory [string]
-T, --transform transform typescript modules to javascript before analyze, it
allows you to omit types dependency in typescript
[boolean] [default: false]
--exit-code exit with specified code, the value format is CASE:CODE,
`circular` is the only supported CASE, CODE should be a integer
between 0 and 128. For example: `dpdm --exit-code circular:1` the
program will exit with code 1 if circular dependency found.
[string]
--progress show progress bar [boolean] [default: true]
--detect-unused-files-from this file is a glob, used for finding unused files. [string]
--skip-dynamic-imports Skip parse import(...) statement.
[string] [choices: "tree", "circular"]
-h, --help Show help [boolean]
import { parseDependencyTree, parseCircular, prettyCircular } from 'dpdm';
parseDependencyTree('./index', {
/* options, see below */
}).then((tree) => {
const circulars = parseCircular(tree);
console.log(prettyCircular(circulars));
});
parseDependencyTree(entries, option, output)
: parse dependencies for glob entries
/**
* @param entries - the glob entries to match
* @param options - the options, see below
*/
export declare function parseDependencyTree(
entries: string | string[],
options: ParserOptions,
): Promise<DependencyTree>;
/**
* the parse options
*/
export interface ParseOptions {
context: string; // context to shorten filename, default is process.cwd()
extensions: string[]; // the custom extensions to resolve file, default is [ '.ts', '.tsx', '.mjs', '.js', '.jsx', '.json' ]
include: RegExp; // the files to parse match regex, default is /\.m?[tj]sx?$/
exclude: RegExp; // the files to ignore parse, default is /\/node_modules\//
}
export enum DependencyKind {
CommonJS = 'CommonJS', // require
StaticImport = 'StaticImport', // import ... from "foo"
DynamicImport = 'DynamicImport', // import("foo")
StaticExport = 'StaticExport', // export ... from "foo"
}
export interface Dependency {
issuer: string;
request: string;
kind: DependencyKind;
id: string | null; // the shortened, resolved filename, if cannot resolve, it will be null
}
// the parse tree result, key is file id, value is its dependencies
// if file is ignored, it will be null
export type DependencyTree = Record<string, Dependency[] | null>;
parseCircular(tree)
: parse circulars in dependency tree
export declare function parseCircular(tree: DependencyTree): string[][];
FAQs
Analyze circular dependencies in your JavaScript/TypeScript projects.
We found that dpdm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.