check-packages

CLI tool to check your npm dependencies against a list of allowed/forbidden packages.

Install

To use it in your project:

$ npm install --save-dev check-packages

To use it globally:

$ npm install --global check-packages

It requires Node.js (v6 or higher).

Usage

$ check-packages <checklist.json> [options]

Checklist JSON File

The content of the checklist file must be an array of package names (with optional semver ranges), e.g.:

[
  "react",
  "react-dom",
  "redux@>=1.0.0-rc.0 <1.0.1",
  "react-redux@^2 <2.2 || > 2.3"
]

By default check-packages uses the checklist path packages-whitelist.json (respectively packages-blacklist.json when called with option --blacklist), but you can also call check-packages with a different checklist path as first argument, e.g.:

$ check-packages "./config/whitelisted-dev-dependencies.json" --dev

Options

| Option | Alias | Description | |----------------|---------|---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | topLevelOnly | | Checks only direct dependencies listed in the top level package.json (equivalent to depth=0).Note: You cannot use topLevelOnly together with depth. | | depth | | Max depth of the dependency tree analysis (default: inifity).Note: You cannot use depth together with topLevelOnly. | | blacklist | black | Interpret content of checklist as blacklist. | | development | dev | Analyze the dependency tree for devDependencies. | | production | prod | Analyze the dependency tree for dependencies. | | verbose | | Lists unallowed dependencies. | | exitCode | | Exit code in case of unallowed dependencies. Default: 1 | | version | v | Displays the version number. | | help | h | Displays the help. |

Examples

$ check-packages
$ check-packages --blacklist
$ check-packages my-whitelist.json --dev --depth=10
$ check-packages my-whitelist.json --dev --topLevelOnly --verbose
$ check-packages my-blacklist.json --prod --blacklist

License

MIT © Christian Kühl