npm / Node.js Scanner

Deptic's npm scanner resolves the complete dependency tree from package.json files found anywhere in the repository. Unlike running npm install, Deptic uses the npm registry API directly — no code execution, no containers, no environment setup required.

Manifest files detected:

Excluded paths:

node_modules/
.yarn/
dist/
build/
.next/
out/
coverage/

Transitive resolution:

Deptic fetches each direct dependency's own package.json from the npm registry and recursively resolves to depth 3. A typical Next.js application has 40–60 direct dependencies and 800–1,200 transitive dependencies.

Example scan output:

{
  "ecosystem": "npm",
  "stats": {
    "inventory_size": 1247,
    "direct_library": 43,
    "transitive": 1204,
    "license_spread": 18
  },
  "top_licenses": ["MIT", "ISC", "Apache-2.0", "BSD-3-Clause"]
}

PURL format for npm:

pkg:npm/lodash@4.17.21
pkg:npm/%40types%2Fnode@20.0.0

Note: Scoped packages (@org/name) are percent-encoded in PURLs.

Known limitations: