I counted the strangers inside famous npm dependency trees

Description and use

Developers cannot see which npm accounts have publish rights in their dependencies, creating a hidden attack surface. The dep‑census CLI reads package-lock.json and reports the number of such accounts.

Problem

Developers cannot see which npm accounts have publish rights in their dependency trees, exposing a hidden attack surface.

Outcome

On popular repositories, the number of strangers (accounts with publish rights) often exceeds the number of packages, with a single account controlling a significant share of the tree.

Workflow

• Run npx dep-census <path-to-package-lock.json> or npx dep-census owner/repo
• The tool parses the lockfile
• It counts every npm account with publish rights
• It outputs a table of accounts and their share of the tree

Evidence

I built a zero-dependency CLI that reads package-lock.json and counts every npm account with publish rights in your tree.

Source

Insomnia's tree has more strangers than packages: 1,786 people can ship code into an app that stores your API keys.

Source

Roughly 55% of packages in every tree I checked are maintained by exactly one account.

Source