
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
Powerful CLI tool to find, filter & format package data in node_modules.
> npm install -g pkgrep
Find, filter & format package data in node_modules.
Usage: pkgrep [options] [name[@version] ...]
...
Options:
-a, --all Match all dependencies. non-zero exit if not all match.
-d, --depth Traversal depth. use --depth=Infinity or --depth=-1 to traverse entire dependency tree. [default: 0]
-f, --format Output format string. Place variables in {curlies}. [default: "{name}@{version}"]
-t, --table Show output in a table. Use --format to indicate desired columns. All non-variables are ignored.
-s, --strict Only list packages which contain all variables in --format.
-x, --filter Filter packages using an arbitrary ES6 expression. No return statement required. Use at own risk.
--dev Include development dependencies.
--extraneous Show extraneous dependencies [default: true]
--no-extraneous Filter extraneous dependencies. This will include --dev dependencies if --dev is not enabled.
--flatten Flatten --json output so there is no object nesting.
--json Generate JSON output. Respects keys used in --format. All non-variables are ignored.
--list-vars List examples of possible --format & --table variables.
--summary Show summary after results on stderr. [default: true]
--no-summary Do not print any summary text to stderr. "e.g. 5 matching dependencies."
--silent No visual output, exit codes only.
--unique Only display unique lines of output. [default: true]
--no-unique Do not remove duplicate lines of output.
--help Show help
--version Show version number
To follow along at home, start with this:
> mkdir pkgrep-cli-test && cd pkgrep-cli-test
> npm init -f
> npm install inherits mkdirp --save
> pkgrep
inherits@2.0.1
mkdirp@0.5.0
2 matching dependencies
You can use --depth in combination with most other flags.
> pkgrep --depth=-1
inherits@2.0.1
mkdirp@0.5.0
minimist@0.0.8
3 matching dependencies
If the package is not installed you'll get a non-zero exit-code:
> pkgrep mkdirp || echo "package is not installed"
mkdirp@0.5.0
1 matching dependency
> pkgrep bower || echo "package is not installed"
No matching dependencies!
package is not installed
You can pass any valid semver version in the format: name@semver:
> pkgrep inherits@2.0.0
No matching dependencies!
> pkgrep inherits@~2.0.0
inherits@2.0.1
1 matching dependency
Only matched packages will be printed. Only non-zero exit code if no packages.
> pkgrep mkdirp inherits bower
inherits@2.0.1
mkdirp@0.5.0
2 matching dependencies.
--all will exit with failure unless all listed packages are matched.
> pkgrep --all mkdirp inherits bower || echo "Failed."
inherits@2.0.1
mkdirp@0.5.0
2 matching dependencies.
2 out of 3 matches.
Failed.
Use --dev to include devDependencies.
> npm install --save-dev tape
> pkgrep tape
No matching dependencies!
> pkgrep tape --dev
tape@3.4.0
1 matching dependency
pkgrep permits using arbitrary ES6 expressions. Use at own risk.
All package keys are in scope, as if the code was executed within a
with statement for each package. No return statement is required for single-line
expressions.
For example, we can list only dependencies that depend on tap in their
devDependencies:
> pkgrep --filter="devDependencies.tap" --depth=-1
NAME VERSION REALPATH
inherits 2.0.1 /Users/timoxley/Projects/get-dependencies/pkgrep-cli-test/node_modules/inherits
mkdirp 0.5.0 /Users/timoxley/Projects/get-dependencies/pkgrep-cli-test/node_modules/mkdirp
2 dependencies.
Use --format to control output. Variables are enclosed in single
{curlies}.
> pkgrep --format="{name}"
inherits
mkdirp
2 dependencies.
> pkgrep --format="{name}@{version} - {realPath}"
inherits@2.0.1 - /Users/timoxley/Projects/test/pkgrep-cli-test/node_modules/inherits
mkdirp@0.5.0 - /Users/timoxley/Projects/test/pkgrep-cli-test/node_modules/mkdirp
2 dependencies.
> pkgrep --format='{name} "{scripts.test}"'
inherits "node test"
mkdirp "tap test/*.js"
2 dependencies.
> pkgrep --list-vars
Possible format keys:
KEY VALUE
name pkgrep-cli-test
version 1.0.0
description
main index.js
scripts.test echo "Error: no test specified" && exit 1
keywords
author.name Tim Oxley
author.email secoif@gmail.com
license ISC
dependencies.inherits ^2.0.1
dependencies.mkdirp ^0.5.0
devDependencies.tape ^3.4.0
readme ERROR: No README data found!
_id pkgrep-cli-test@1.0.0
realName pkgrep-cli-test
extraneous false
path /Users/timoxley/test/pkgrep-cli-test
realPath /Users/timoxley/test/pkgrep-cli-test
link
depth 0
peerDependencies [object Object]
root true
Formatting courtesy of columnify.
> pkgrep --table
pkgrep --table --depth=-1
NAME VERSION
inherits 2.0.1
mkdirp 0.5.0
minimist 0.0.8
deep-equal 0.2.1
defined 0.0.0
glob 3.2.11
minimatch 0.3.0
lru-cache 2.5.0
sigmund 1.0.0
object-inspect 0.4.0
resumer 0.0.0
through 2.3.6
12 dependencies.
To make it easy to flip between text and table output, all whitespace &
non-variable characters in the --format string are totally ignored.
The variables are collected and used as table columns.
> pkgrep --format="{name}@{version} - {realPath}" --table
NAME VERSION REALPATH
inherits 2.0.1 /Users/timoxley/Projects/get-dependencies/pkgrep-cli-test/node_modules/inherits
mkdirp 0.5.0 /Users/timoxley/Projects/get-dependencies/pkgrep-cli-test/node_modules/mkdirp
2 dependencies.
Use --json to get JSON Output.
> pkgrep --format="{name} {scripts.test}" --json
[
{
"name": "inherits",
"scripts": {
"test": "node test"
}
},
{
"name": "mkdirp",
"scripts": {
"test": "tap test/*.js"
}
}
]
2 dependencies.
Use --flatten with --json to remove JSON object nesting.
> pkgrep --format="{name} {scripts.test}" --json --flatten
[
{
"name": "inherits",
"scripts.test": "node test"
},
{
"name": "mkdirp",
"scripts.test": "tap test/*.js"
}
]
2 dependencies.
MIT
FAQs
Powerful CLI tool to find, filter & format package data in node_modules.
We found that pkgrep demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.