Npm Dependency and Lock Metadata Inspector

How to use Npm Dependency and Lock Metadata Inspector

Compare package.json dependency declarations with an npm lockfile and inspect repeated versions and install-script metadata. Find changed saved specifier text and missing top-level lock entries without installing packages. Retain dependency-section distinctions and show all supplied package locations rather than claiming a complete npm resolution.

1. Provide package.json source, package-lock.json version 2 or 3.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• 100 KB of duplicate-free JSON per input, 40 parsed levels, 1,000 distinct direct names and 4,000 supplied package locations. Dependency specifiers are bounded nonempty single-line strings.
• npm lockfile versions 2 and 3 with packages[""] only. Version-1 lockfiles, pnpm/yarn locks, workspace/link traversal and package-manager-specific install simulation are not supported.
• A changed saved specifier is a literal metadata difference, not a claim that installed versions violate semver. Optional and peer entries can legitimately be absent; no platform or npm configuration is inferred.
• Repeated installed version strings and hasInstallScript flags come only from the supplied lock metadata. No package fetch, script, security audit or cryptographic integrity verification runs.
• Inputs are processed on this device and are not automatically saved or uploaded.