I wrote a dependency scanner with zero dependencies

Описание и применение

depx – полностью автономный сканер зависимостей, использующий только стандартную библиотеку Node.js, устраняет внешние зависимости и защищает от атак slopsquatting.

Задача

Dependency scanners often bring their own dependencies, creating a circular problem and making them vulnerable to slopsquatting attacks where attackers register package names suggested by AI models.

Результат

depx achieves zero external dependencies, reduces attack surface, and provides a reliable, testable terminal UI, all within 72 hours of development.

Рабочий процесс

• 1. Read repository source files
• 2. Mask comments, strings, regexes, and template literals while preserving byte offsets
• 3. Identify string literals in import positions via regex on preceding code
• 4. Resolve each import against package.json and node_modules
• 5. Report discrepancies with file:line:column info
• 6. Render a full-screen terminal UI using node:readline and escape codes, no external UI libraries
• 7. Allow live search, arrow navigation, and open $EDITOR on selection

Доказательства

depx reads a repository's source, extracts every import, resolves each one against the manifest and the install tree, and reports where the two disagree.

Источник