# package.json Dependency Auditor

Audit a package.json for dependency hygiene, version-range quality, and optionally inspect a transitive dependency tree from package-lock.json or yarn.lock. Flags duplicates, wildcard or pre-release specs, unsorted keys, missing metadata, and misclassified runtime/dev dependencies.

> Canonical page: https://elysiatools.com/en/tools/package-json-dependency-auditor

- **Category:** Development

- **Keywords:** package.json, dependency audit, package-lock, yarn lock, dependency tree, semver, duplicate dependencies, version range, node.js, frontend, linter, code review, engines, license, dependency hygiene

## Overview

A package.json auditor for Node.js / frontend engineers, library authors and code reviewers:

1. Paste the contents of a package.json.
2. Pick strictness: Strict flags everything, Standard is the sensible default, Lenient focuses on serious issues.
3. Version analysis classifies each dependency spec (caret / tilde / exact / wildcard / workspace / alias / git-url / comparator) and shows the minimum satisfiable version when available.
4. Deep exploration is optional: paste package-lock.json or Yarn v1 yarn.lock to resolve transitive versions and build a dependency tree.
5. Report sections include a grade, findings list, version-policy table, optional dependency table, and optional resolved dependency tree.

Offline-first: without a lockfile the tool still audits direct dependencies, but transitive resolution stays disabled by design.

## Inputs

- **package.json content** (textarea): { "name": "my-app", "dependencies": { ... } }
- **Strictness** (select)
- **Show dependency table** (checkbox)
- **Lockfile type** (select)
- **Lockfile content (optional)** (textarea): { "lockfileVersion": 3, ... } or yarn.lock text
- **Show dependency tree** (checkbox)
- **Tree depth** (number)

## When to use

- Before publishing a library to npm to ensure clean version ranges and prevent runtime dependency leaks.
- During code reviews to verify that new dependencies are correctly classified and sorted.
- When troubleshooting dependency bloat or duplicate packages in your node_modules directory.

## How it works

- Paste your package.json content and optionally paste your package-lock.json or yarn.lock file.
- Select your preferred strictness level and configure display options like dependency tables or tree depth.
- The auditor parses the semver ranges, checks for duplicates, and resolves transitive dependencies if a lockfile is provided.
- Review the generated HTML report containing your project grade, specific findings, and a visual dependency tree.

## Use cases

- Auditing a legacy project's package.json to clean up wildcard versions and unused dependencies.
- Validating package.json structure and sorting before committing changes to a shared repository.
- Visualizing transitive dependency paths to locate the source of a bloated sub-dependency.

## Frequently asked questions

### Do I need to upload a lockfile to use this tool?

No, a lockfile is optional. Without it, the tool audits direct dependencies but disables transitive dependency tree resolution.

### What does the strictness setting change?

Strict flags all minor issues like unsorted keys, Standard uses sensible defaults for general hygiene, and Lenient only highlights critical errors.

### Which lockfile formats are supported?

The auditor supports npm package-lock.json and Yarn v1 yarn.lock files.

### How does the tool identify duplicate dependencies?

It flags packages that are declared in both dependencies and devDependencies, or resolved to multiple conflicting versions in the lockfile.

### Is my package.json data sent to a server?

No, the auditor runs entirely in your browser, ensuring your dependency manifests and lockfiles remain private.

## Related tools

- [JWK Generator & Parser](https://elysiatools.com/en/tools/jwk-generator): Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata
- [SQL Explain Plan Visualizer](https://elysiatools.com/en/tools/sql-explain-plan-visualizer): Parse EXPLAIN / EXPLAIN ANALYZE output (PostgreSQL/MySQL/SQLite) into a cost tree, flag estimated-vs-actual row divergence, and suggest indexes
- [GraphQL Playground](https://elysiatools.com/en/tools/graphql-playground): An in-browser GraphQL client: write queries and variables, send them to any GraphQL endpoint, and inspect formatted JSON results or error arrays — perfect for iterating on schemas during development
- [Tailwind Color Palette Sync](https://elysiatools.com/en/tools/tailwind-color-palette-sync): Generate theme.extend.colors for tailwind.config.ts from HEX colors, with WCAG contrast levels and optional dark mode.
- [ECharts Theme Token Extractor](https://elysiatools.com/en/tools/echarts-theme-token-extractor): Extract design tokens — colors, numbers, font sizes and strings — from an ECharts theme JSON and export them straight into your design system. Paste a theme object (the kind registered via echarts.init(dom, themeName)) and the tool walks every leaf, tagging each color (with optional named/rgb → hex normalization), spacing number, font size and string, then emits clean CSS variables, a Tailwind theme.extend config, Style Dictionary tokens.json, or SCSS variables. Bridges the gap between an ECharts visualization theme and Figma/CSS/Tailwind design tokens without copying each value by hand.
- [Image Palette to Design Tokens](https://elysiatools.com/en/tools/image-to-design-tokens): Extract a dominant color palette from an image (k-means clustering), then export it as CSS variables, SCSS variables, a Tailwind config, or JSON design tokens — with named colors and an auto-generated shade scale for each
- [Short URL + UTM + QR Bundle Builder](https://elysiatools.com/en/tools/short-url-utm-builder-qr-bundle): One pass replaces bit.ly + Campaign URL Builder + QR generator: GA4-validated UTM parameters, a deterministic self-hosted short link (FNV-1a base62 slug), QR pair, redirect snippets and a tracking CSV row.
- [Time Series Forecast & Seasonality Analyzer](https://elysiatools.com/en/tools/time-series-forecast-seasonality-analyzer): Forecast future periods from CSV or JSON time-series data and inspect trend, seasonal, and residual decomposition in one report

## Samples

- [Terraform Plan JSON Samples](https://elysiatools.com/en/samples/terraform-plan-json-samples): Sample Terraform plan JSON files exported from terraform show -json style payloads for dependency visualization and change review
- [pnpm Package Manager Samples](https://elysiatools.com/en/samples/pnpm): Fast, disk space efficient package manager examples including monorepo management, workspace configuration, and advanced workflows
- [Chat Transcript JSON Samples](https://elysiatools.com/en/samples/chat-transcript-json): JSON examples for multi-role chat transcripts
- [JSON Samples](https://elysiatools.com/en/samples/json): JSON (JavaScript Object Notation) format examples from simple to complex structures

## Related content

- [API Versioning, Breaking Change, and Release Readiness Tools](https://elysiatools.com/en/hubs/api-versioning-breaking-change-review): Compare API versions, surface breaking schema changes, validate real response compatibility, review semver and changelogs, and prepare cleaner release handoffs in one focused hub.
- [JSON Interchange and Format Translation Tools](https://elysiatools.com/en/hubs/json-convert): Compare JSON conversion tools for CSV, YAML, TOML, GraphQL, XML, Markdown, Excel, BSON, EDN, and related structured formats in one hub.
- [JSON Inspection, Diff, and Transformation Tools](https://elysiatools.com/en/hubs/json-utility): Compare JSON formatting, diffing, path inspection, schema validation, merging, transformation, and export tools in one hub for API and data workflows.
- [JSON Schema, Mock Data, and API Fixture Generators](https://elysiatools.com/en/hubs/json-generate): Curated tools for JSON schema generation, mock payload building, and API fixture preparation in one hub.