{"_id":"@damusix/dep-scanner","name":"@damusix/dep-scanner","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"@damusix/dep-scanner","version":"1.0.0","description":"A tool for discovering dependencies recursively across package.json and common lock files, useful for finding vulnerabilities and package versions deeply nested in your projects","main":"dep-scanner","bin":{"dep-scanner":"dep-scanner"},"scripts":{"test":"echo \"Error: no test specified\" && exit 1"},"keywords":["dependency","scanner","vulnerability","npm","yarn","pnpm","lockfile","package","audit","security"],"author":{"name":"Danilo Alonso","email":"danilo@alonso.network"},"license":"MIT","homepage":"https://www.npmjs.com/package/@damusix/dep-scanner","repository":{"type":"git","url":"https://gist.githubusercontent.com/damusix/b46c5243bda2962a78f0f3eb6a80a1fb"},"engines":{"node":">=18.0.0"},"packageManager":"pnpm@10.15.0","_id":"@damusix/dep-scanner@1.0.0","_nodeVersion":"22.14.0","_npmVersion":"10.9.2","dist":{"integrity":"sha512-78mD5jJA+c+YXU0s2DSQNcyjbiJBgTwTrTO2ylmV5LGxTU92LeO6yT73HiT94EmE/W+chNFQxo6DZvw3hq765w==","shasum":"5100db3ea25cbe920719fa0af6aac2f55a68d1a8","tarball":"https://registry.npmjs.org/@damusix/dep-scanner/-/dep-scanner-1.0.0.tgz","fileCount":4,"unpackedSize":18701,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIGmnwPynspHvjC0qhb6VEXIys9P5jmAkh/72loLs1m2EAiBeUVN6sUYVwMnYX5orhX0Vyq2SwRM6zSODzMrSmNN+xw=="}]},"_npmUser":{"name":"damusix","email":"damusix@gmail.com"},"directories":{},"maintainers":[{"name":"damusix","email":"damusix@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/dep-scanner_1.0.0_1757470416076_0.33739517302464583"},"_hasShrinkwrap":false}},"time":{"created":"2025-09-10T02:13:35.956Z","1.0.0":"2025-09-10T02:13:36.315Z","modified":"2025-09-10T02:13:36.640Z"},"maintainers":[{"name":"damusix","email":"damusix@gmail.com"}],"description":"A tool for discovering dependencies recursively across package.json and common lock files, useful for finding vulnerabilities and package versions deeply nested in your projects","homepage":"https://www.npmjs.com/package/@damusix/dep-scanner","keywords":["dependency","scanner","vulnerability","npm","yarn","pnpm","lockfile","package","audit","security"],"repository":{"type":"git","url":"https://gist.githubusercontent.com/damusix/b46c5243bda2962a78f0f3eb6a80a1fb"},"author":{"name":"Danilo Alonso","email":"danilo@alonso.network"},"license":"MIT","readme":"# Dependency Scanner\n\n\n[![npm version](https://badge.fury.io/js/@damusix%2Fdep-scanner.svg)](https://www.npmjs.com/package/@damusix/dep-scanner)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n\nA tool for discovering dependencies recursively across package.json and common lock files, useful for finding vulnerabilities and package versions deeply nested in your projects.\n\n\n## Features\n\n\n- Search `pnpm-lock.yaml`, `yarn.lock`, `package-lock.json`, `npm-shrinkwrap.json`, and `package.json` files recursively\n- Accept packages via a `-p` comma-separated argument or via file/stdin (`-f file`, `-f -`, `--stdin`)\n- Validate package names and basic semver versions; invalid lines are warned and ignored\n- Works with piped input (e.g., clipboard via `pbpaste`) and can be run from any root path with `-r`\n- Lightweight implementation using dynamic regex matching\n- No external dependencies\n\n\n## Installation\n\n\n### Global Installation\n\nInstall globally using npm:\n\n    npm install -g @damusix/dep-scanner\n\nOr using pnpm:\n\n    pnpm add -g @damusix/dep-scanner\n\nOr using yarn:\n\n    yarn global add @damusix/dep-scanner\n\n\n### Run without Installation\n\nYou can also run `dep-scanner` directly without installing it globally using `npx`:\n\n    npx dep-scanner -p express,lodash\n\n\n## Usage\n\n\nAfter installation, the `dep-scanner` command will be available globally.\n\n### Scan packages specified directly:\n\n    dep-scanner -p express@4.18.2,lodash -r /path/to/repo\n\n### Scan packages from a file:\n\n    dep-scanner -f packages.txt -r /path/to/repo\n\n### Pipe clipboard or other stream into the scanner:\n\n    pbpaste | dep-scanner -f - -r /path/to/repo\n    pbpaste | dep-scanner --stdin -r /path/to/repo\n\n### Auto-detect piped stdin (no `-p` or `-f`):\n\n    pbpaste | dep-scanner -r /path/to/repo\n\n### Scan current directory:\n\n    dep-scanner -p express,react\n\n### Command Options\n\n- `-p`: Comma-separated packages (version optional). Example: `-p pkg@1.0.0,@scope/pkg@2.0.1,pkg2`\n- `-f`: File with newline-separated entries, format: `package=version` or `package@version` (version optional)\n- `-r`: Root path to start searching from (defaults to current working directory)\n- `-h`: Show help message\n\n\n## Examples\n\n\n### Finding a specific vulnerable package version:\n\n    dep-scanner -p minimist@1.2.5 -r ~/projects/myapp\n\n### Checking multiple packages from a file:\n\nCreate a file `vulnerable-packages.txt`:\n\n    lodash@4.17.20\n    minimist@1.2.5\n    axios@0.21.0\n\nThen run:\n\n    dep-scanner -f vulnerable-packages.txt -r ~/projects\n\n### Quick clipboard scan (macOS):\n\nCopy a list of packages to clipboard, then:\n\n    pbpaste | dep-scanner --stdin\n\n\n## Notes\n\n\n- This tool uses dynamic regex matches and may produce false positives for unusual file formats\n- It's intended for quick repository searches, not authoritative dependency resolution\n- The tool searches through lock files and package.json without parsing them as JSON/YAML\n\n\n## Author\n\n\nDanilo Alonso <danilo@alonso.network>\n\n\n## License\n\n\nMIT\n\n\n## Repository\n\n\n[GitHub Gist](https://gist.githubusercontent.com/damusix/b46c5243bda2962a78f0f3eb6a80a1fb)","readmeFilename":"README.md","_rev":"1-2c0c6427b6e21035c9dad93289f0f882"}