A command line tool that glance over package lockfile.
The lockfile is reading from stdin only. i.e.
cat package-lock.json | npx pkg-fence <...>
[!NOTE] Currently only support
package-lock.jsonornpm-shrinkwrap.json(could usenpm shrinkwrapto generate it on-the-fly).
Exit code: 0 for empty results, 1 for anything matched.
--lodash: pkg naming starts by lodash. or equals to lodash--nolyfill: list of names from https://github.com/SukkaW/nolyfill--relief: list of names from https://github.com/es-tooling/module-replacements
--relief-native--relief-micro--relief-preferredto specify addition names:
--extra abc --extra def --extra=foo,bar
to ignore some names:
--ignore abc --ignore def --ignore=foo,bar
executable only
npx pkg-fence
bun x pkg-fence
pnpm dlx pkg-fence
yarn dlx pkg-fence
deno run npm:pkg-fence
executable, multi ESM exports, Typing
deno run jsr:@imcotton/pkg-fence
Does not differentiate between dev or non-dev dependencies.
npm ls ... or npm why ... to make further inspectionResults are unordered, possible in duplications.
sort, uniq, or grep etc...AGPLv3
[0.5.1] - 2024-07-13
FAQs
A command line tool that glance over package dependencies.
The npm package pkg-fence receives a total of 6 weekly downloads. As such, pkg-fence popularity was classified as not popular.
We found that pkg-fence demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
Security News
A Stanford study reveals 9.5% of engineers contribute almost nothing, costing tech $90B annually, with remote work fueling the rise of "ghost engineers."