depx
Understand what's in your node_modules and Cargo.lock.
A fast, intelligent dependency analyzer for JavaScript/TypeScript and Rust projects. Built in Rust for performance.
Why depx?
Your node_modules has hundreds of packages. Do you know:
- Which ones are actually imported in your code?
- Why
is-oddis even installed? - If that vulnerability alert affects code you actually use?
Existing tools (npm ls, npm audit, depcheck) give fragmented information without real context. depx connects the dots.
Installation
Commands
depx analyze - Find unused dependencies
)
)
Smart detection separates truly unused packages from dev/build tools that aren't meant to be imported (@types/*, typescript, eslint, vitest, etc).
depx why <package> - Explain why a package is installed
Shows the full dependency chain from your package.json to any transitive dependency.
depx audit - Check for real vulnerabilities
Unlike npm audit, depx queries the OSV database with your exact installed versions, eliminating false positives from old CVEs that don't affect you.
depx deprecated - Find deprecated packages
depx duplicates - Detect duplicate dependencies (Rust/Cargo)
)
)
)
! )
)
Identifies when multiple versions of the same crate exist in your project, calculates the impact (extra compile units), and suggests which dependencies to update.
Options:
--verbose/-v- Show all duplicates including low severity, with upgrade suggestions--json- Output as JSON for programmatic use
Features
- Fast - Written in Rust, parses JS/TS with oxc
- Smart - Distinguishes real unused deps from expected dev tools
- Accurate - Version-aware vulnerability scanning (no false positives)
- Complete - Handles ES modules, CommonJS, dynamic imports, re-exports
Supported lockfiles
-
Cargo.lock(Rust) - duplicates detection -
package-lock.json(npm) - full analysis -
pnpm-lock.yaml(coming soon) -
yarn.lock(coming soon)
Built with AI
This project was built in partnership with Claude (Anthropic). I define the architecture, make decisions, review code, and handle the direction. Claude helps write code faster.
I believe AI is a tool, not a replacement. The developer still needs to understand the problem, evaluate solutions, and take responsibility for the result. AI just accelerates execution.
You can see Claude as a contributor in this repo, that's intentional transparency.
License
MIT