I counted the strangers inside famous npm dependency trees

说明与用途

开发者无法看到 npm 依赖树中哪些账户拥有发布权限，导致隐藏的攻击面。dep‑census CLI 读取 package-lock.json 并报告这些账户的数量。

问题

Developers cannot see which npm accounts have publish rights in their dependency trees, exposing a hidden attack surface.

结果

On popular repositories, the number of strangers (accounts with publish rights) often exceeds the number of packages, with a single account controlling a significant share of the tree.

工作流

• Run npx dep-census <path-to-package-lock.json> or npx dep-census owner/repo
• The tool parses the lockfile
• It counts every npm account with publish rights
• It outputs a table of accounts and their share of the tree

证据

I built a zero-dependency CLI that reads package-lock.json and counts every npm account with publish rights in your tree.

来源

Insomnia's tree has more strangers than packages: 1,786 people can ship code into an app that stores your API keys.

来源

Roughly 55% of packages in every tree I checked are maintained by exactly one account.

来源