
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
insightcode-cli
Advanced tools
TypeScript code quality analyzer that runs 100% locally. Get actionable metrics in seconds without sending any code to the cloud.
# Install globally
npm install -g insightcode-cli
# Simple analysis (new default behavior)
insightcode
# Analyze specific path
insightcode ./src
# Focus on production code only
insightcode --production
# Use industry-standard strict duplication thresholds
insightcode --strict-duplication
# Export for CI/CD integration
insightcode --json > report.json
# Multiple format options
insightcode --format=summary # Brief overview
insightcode --format=critical # Only critical files
insightcode --format=ci # CI/CD friendly output
Real analysis of the Angular project using insightcode --production ./angular/packages:
🔍 Analyzing code quality...
📁 Found 4282 files
📊 Extracting file details...
⚙️ Processing metrics...
📈 Calculating overview...
┌────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ packages vlatest (local, 0 stars) │
│ Analysis from Jul 25, 2025, took 0.0s │
└────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
┌──────────────────────────┬────────────────────────────────────────────────────────────────────┬────────────┐
│ OVERVIEW: GRADE B (85) │ 1174 critical files found requiring attention │ │
├──────────────────────────┼────────────────────────────────────────────────────────────────────┼────────────┤
│ Complexity │ ██████████████████████████████████████████████████░░░░░░░░░░░░░░ │ 78 │
│ │ │ │
│ Duplication │ █████████████████████████████████████████████████████████████░░░ │ 96 (5%) │
│ │ │ │
│ Maintainability │ ██████████████████████████████████████████████████████░░░░░░░░░░ │ 85 │
└──────────────────────────┴────────────────────────────────────────────────────────────────────┴────────────┘
┌─────────────────────────────────────────────────────┬──────────────────────────────────────────────────────┐
│ KEY STATS │ BUSINESS IMPACT │
├─────────────────────────────────────────────────────┼──────────────────────────────────────────────────────┤
│ Total Files 4282 │ 🚨 High Maintenance Cost 885 │
│ Total LOC 582k │ 🐌 Slow to Change Files 556 │
│ Avg Complexity 10.7 │ 🔗 Tightly Coupled Files 783 │
└─────────────────────────────────────────────────────┴──────────────────────────────────────────────────────┘
┌ CRITICAL FILES REQUIRING ATTENTION ────────────────────────────────────────────────────────────────────────┐
│ S │ File Path │ Metrics │ Primary Issue │
├────┼────────────────────────────────────────────────┼───────────────────────┼──────────────────────────────┤
│ 0 │ common/locales/closure-locale.ts │ C: 548 D: 0% L: 1k │ 💀 complexity (critical) │
│ 0 │ compiler-cli/.../type_check_block.ts │ C: 451 D: 0% L: 2k │ 💀 complexity (critical) │
│ 0 │ compiler/src/output/output_ast.ts │ C: 391 D: 0% L: 2k │ 💀 complexity (critical) │
│ 0 │ compiler/src/ml_parser/lexer.ts │ C: 322 D: 8% L: 1k │ 💀 complexity (critical) │
│ 0 │ compiler/.../expression.ts │ C: 311 D: 0% L: 1k │ 💀 complexity (critical) │
│ 0 │ compiler-cli/.../handler.ts │ C: 306 D: 0% L: 2k │ 💀 complexity (critical) │
└────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
DEEP DIVE: KEY FUNCTION ANALYSIS
──────────────────────────────────────────────────────────────────────────────────────────────────────────────
🎯 reifyCreateOperations in compiler/src/template/pipeline/src/phases/reify.ts
Metrics: Complexity: 86 | Lines: 359 | Params: 2
Detected Issues:
- critical-complexity (critical) : Severely impacts maintainability
- long-function (high) : Should be split into smaller functions
- deep-nesting (medium) : Hard to read and test
- multiple-responsibilities (medium): Clean separation of concerns
· · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · ·
🎯 resolve in compiler-cli/.../handler.ts
Metrics: Complexity: 84 | Lines: 501 | Params: 3
Detected Issues:
- critical-complexity (critical) : Severely impacts maintainability
- long-function (high) : Should be split into smaller functions
- multiple-responsibilities (high): Clean separation of concerns
- deep-nesting (medium) : Hard to read and test
- impure-function (low) : Side effects make testing harder
· · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · ·
🎯 getDateFormatter in common/src/i18n/format_date.ts
Metrics: Complexity: 82 | Lines: 309 | Params: 1
Detected Issues:
- critical-complexity (critical) : Severely impacts maintainability
- long-function (high) : Should be split into smaller functions
- multiple-responsibilities (medium): Clean separation of concerns
· · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · ·
🎯 transformExpressionsInOp in compiler/.../expression.ts
Metrics: Complexity: 72 | Lines: 152 | Params: 3
Detected Issues:
- critical-complexity (critical) : Severely impacts maintainability
- long-function (high) : Should be split into smaller functions
- multiple-responsibilities (high): Clean separation of concerns
- deep-nesting (medium) : Hard to read and test
· · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · · ·
🎯 analyze in compiler-cli/.../handler.ts
Metrics: Complexity: 59 | Lines: 487 | Params: 2
Detected Issues:
- critical-complexity (critical) : Severely impacts maintainability
- long-function (high) : Should be split into smaller functions
- god-function (high) : Violates Single Responsibility
- multiple-responsibilities (high): Clean separation of concerns
- deep-nesting (medium) : Hard to read and test
- impure-function (low) : Side effects make testing harder
InsightCode's analysis is built on a "criticality-first" philosophy. It first measures the fundamentals in each file, then uses project-wide context to weigh them based on their actual importance.
Counts decision points in your code. Based on McCabe's complexity metric (extended to include logical operators):
if, else if, for, while, switch case, catch, &&, ||, ? :function validate(user) { // Base: 1
if (!user) return false; // +1 for if
if (user.age < 18) return false; // +1 for if
return user.active && user.verified; // +1 for &&
} // Total: 4
Detects actual copy-paste duplication using pragmatic content analysis:
Composite score based on file size and function density:
Measures potential defects and code quality issues:
The final project score is a weighted average across four dimensions (complexity, duplication, maintainability, reliability), with individual file scores weighted by criticality.
Instead of a fixed weight, the weight of each file is determined by its Criticality Score. This score is calculated from the file's own complexity combined with its Impact—how many other files in the project depend on it.
This means issues in important, highly-connected files will affect your final grade more, guiding you to fix what truly matters.
InsightCode uses graduated thresholds aligned with industry standards:
| Grade | Score | What it means |
|---|---|---|
| A | 90-100 | Exceptional! Keep it up |
| B | 80-89 | Good, minor improvements possible |
| C | 70-79 | Fair, consider refactoring |
| D | 60-69 | Poor, needs attention |
| F | 0-59 | Critical, major refactoring needed |
Real-World Context: Based on our analysis of 9 popular projects:
A low score doesn't mean the code is "bad," but that it presents significant maintenance challenges according to our metrics.
Different file types have different standards:
| File Type | Complexity | File Size | Duplication |
|---|---|---|---|
| Production | ≤10 / ≤20 | ≤200 / ≤300 | ≤15% / ≤30% |
| Test Files | ≤15 / ≤30 | ≤300 / ≤500 | ≤25% / ≤50% |
| Examples | ≤20 / ≤40 | ≤150 / ≤250 | ≤50% / ≤80% |
Format: Medium threshold / High threshold
Focus on what matters - your actual product code:
# Analyze only production code
insightcode --production
# This excludes:
# - Test files (**/test/**, *.spec.ts, *.test.js)
# - Example code (**/examples/**, **/demo/**)
# - Scripts & tools (**/scripts/**, **/tools/**)
# - Fixtures & mocks (**/fixtures/**, **/mocks/**)
# - Benchmark files (**/benchmark/**)
Test files and examples often have acceptable duplication and complexity that can mask real issues:
| Project | Full Codebase Analysis | Production Only | Impact |
|---|---|---|---|
| Chalk | A (96) | B (82) | Core is more complex than it appears |
| TypeScript | C (76) | F (28) | Massive algorithmic complexity in compiler |
| Commander | C (80) | F (54) | Command parsing logic needs refactoring |
The production-only analysis gives you the true picture of your codebase health.
# Analysis modes
insightcode # Default: analyze current directory
insightcode ./src # Analyze specific path
insightcode --production # Focus on production code only
# Duplication analysis modes (v0.6.0+)
insightcode --strict-duplication # Industry standards (3%/8%/15%)
insightcode # Legacy mode (15%/30%/50%) - default
# Output formats
insightcode --json # Full JSON output
insightcode --format=summary # Brief overview
insightcode --format=critical # Only critical files
insightcode --format=ci # CI/CD optimized output
insightcode --format=markdown # Markdown report
# Filtering
insightcode --exclude "**/*.spec.ts" --exclude "**/vendor/**"
# Get help
insightcode --help
Choose the appropriate duplication analysis mode for your project context:
| Mode | Thresholds | Best For | Example Usage |
|---|---|---|---|
| Legacy (default) | 15%/30%/50% | Existing codebases, gradual improvement | insightcode |
| Strict | 3%/8%/15% | New projects, industry alignment | insightcode --strict-duplication |
Strict mode aligns with industry standards (SonarQube, Google, etc.) while Legacy mode provides more permissive thresholds suitable for brownfield projects.
The --json flag outputs comprehensive analysis results in a structured format.
--production to focus on what matters📖 Complete Guide: How to Use Code Quality Scores Wisely
| Your Score | What It Means | Action |
|---|---|---|
| A (90-100) | Excellent code quality | Maintain standards |
| B (80-89) | Good, production-ready | Monitor complexity growth |
| C (70-79) | Typical active project | Review top 5 issues |
| D-F (0-69) | Needs attention | Check if justified or refactor |
--strict-duplication flag for industry-standard thresholds (3%/8%/15%)analyze subcommand removed--exclude-utility → --production for better clarity--with-context flag no longer availablenpm run typecheck, improved error handling, unified validation toolsContributions welcome! This is a solo side project, so please be patient with reviews.
# Clone and setup
git clone https://github.com/fstepho/insightcode-cli.git
cd insightcode-cli
npm install
# Development
npm run dev # Run with tsx watch
npm test # Run tests
npm run build # Build for production
InsightCode uses evidence-based thresholds:
Built with:
MIT - Use it, fork it, improve it!
Latest: v0.7.1 | Downloads: | Stars: ⭐ the repo if you find it useful!
FAQs
TypeScript code quality analyzer that runs 100% locally
The npm package insightcode-cli receives a total of 24 weekly downloads. As such, insightcode-cli popularity was classified as not popular.
We found that insightcode-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.