I wrote a dependency scanner with zero dependencies

说明与用途

depx 是一个完全离线的依赖扫描器，仅使用 Node.js 标准库，消除了外部依赖并防止 slopsquatting 攻击。

问题

Dependency scanners often bring their own dependencies, creating a circular problem and making them vulnerable to slopsquatting attacks where attackers register package names suggested by AI models.

结果

depx achieves zero external dependencies, reduces attack surface, and provides a reliable, testable terminal UI, all within 72 hours of development.

工作流

• 1. Read repository source files
• 2. Mask comments, strings, regexes, and template literals while preserving byte offsets
• 3. Identify string literals in import positions via regex on preceding code
• 4. Resolve each import against package.json and node_modules
• 5. Report discrepancies with file:line:column info
• 6. Render a full-screen terminal UI using node:readline and escape codes, no external UI libraries
• 7. Allow live search, arrow navigation, and open $EDITOR on selection

证据

depx reads a repository's source, extracts every import, resolves each one against the manifest and the install tree, and reports where the two disagree.

来源