
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A CLI tool for analyzing code quality in TypeScript and JavaScript projects. Vibequal measures architectural coupling, code complexity, and maintainability to help identify problem areas in your codebase.
npm install
npm run build
npm link # Makes 'vibequal' available globally
vibequal <directory> [options]
| Option | Description |
|---|---|
-v, --verbose | Show detailed metrics for all modules |
-j, --json | Output results as JSON |
-t, --tsconfig <path> | Path to tsconfig.json file |
--no-complexity | Skip complexity analysis |
vibequal ./src # Analyze src directory
vibequal ./src -v # Verbose output with all module details
vibequal ./src -j # JSON output for CI integration
vibequal ./src -t ./tsconfig.json # Specify custom tsconfig
Vibequal analyzes module dependencies to calculate coupling metrics based on Robert C. Martin's stability metrics.
| Metric | Description |
|---|---|
| Afferent Coupling (Ca) | Number of modules that depend on this module (incoming dependencies) |
| Efferent Coupling (Ce) | Number of modules this module depends on (outgoing dependencies) |
| Instability (I) | Ratio of efferent to total coupling: Ce / (Ca + Ce). Range 0-1, where 0 = maximally stable, 1 = maximally unstable |
The report highlights:
| Issue | Description |
|---|---|
| Circular Dependencies | Chains of modules that depend on each other in a cycle (A → B → C → A) |
| Orphan Modules | Modules with no incoming dependencies that may indicate dead code. Entry points and type definitions are filtered out automatically. |
Function-level complexity analysis using the TypeScript compiler API.
| Metric | Description | Thresholds |
|---|---|---|
| Maintainability Index | Composite score (0-100) based on Halstead volume, cyclomatic complexity, and lines of code. Higher is better. | < 20 poor, < 50 moderate, >= 50 good |
| Cyclomatic Complexity | Number of linearly independent paths through the code. Counts decision points (if, for, while, case, catch, ternary, &&, ||, ??) | > 10 high, > 5 moderate |
| Cognitive Complexity | SonarSource's metric measuring how difficult code is to understand. Accounts for nesting depth and control flow breaks. | > 15 high, > 8 moderate |
| Max Nesting Depth | Deepest level of nested control structures | > 3 high, > 2 moderate |
| Arity | Number of function parameters | > 4 high, > 2 moderate |
| Fan-out | Number of unique external function/constructor calls | > 10 high, > 5 moderate |
| Metric | Description |
|---|---|
| LCOM4 | Lack of Cohesion in Methods. Counts connected components of methods that share fields or call each other. A value > 1 suggests the class has multiple responsibilities and should be split. |
For each complexity metric, Vibequal reports:
Use -j for machine-readable output suitable for CI pipelines:
vibequal ./src -j > report.json
The JSON includes all metrics, allowing integration with quality gates and trend tracking.
Vibequal includes a /quality slash command for Claude Code that analyzes your codebase and provides actionable insights.
Install vibequal globally:
npm install -g vibequal
# or from source:
git clone <repo>
cd vibequal && npm install && npm run build && npm link
Copy the .claude/commands/ directory to your project:
cp -r /path/to/vibequal/.claude/commands/ your-project/.claude/commands/
Or to install globally for all projects:
cp -r /path/to/vibequal/.claude/commands/ ~/.claude/commands/
In Claude Code, run:
/quality
Or analyze a specific directory:
/quality src/
Claude will run the analysis and provide:
.ts, .tsx.js, .jsx, .mjs, .cjsAutomatically excludes:
node_modules/dist/, build/*.test.*, *.spec.*)*.d.ts)ISC
FAQs
CLI tool to measure architectural coupling in TypeScript/JavaScript projects
We found that vibequal demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.