Free tool
npm dependency check
Paste a package.json, or a few package names. Each dependency is looked up on the npm registry and in the OSV advisory database: how far it is behind, whether it is deprecated, which published advisories affect the range you declared, and what each package released lately. Your package.json is not stored.
Questions
Is my package.json stored?
No. It is read once to list your dependencies, each one is looked up on the npm registry and in the OSV advisory database, and what you paste is not saved or logged. The release feed keeps a shared copy of each public package's releases and advisories, the same for everyone, with no trace of who asked or which range they declared.
Why is an advisory shown when I may have a newer version installed?
A package.json gives a range, not the installed version. The check reads advisories against the lowest version the range allows, which is what a fresh install without a lockfile can resolve to. Raising the floor of the range clears it.
What does the share link contain?
Only the package names and the ranges, in the address itself. Opening it runs the same check again; nothing is kept on our side to look up.
Why are some dependencies not checked?
Workspace links, git URLs, local paths, dist-tags such as latest and ranges with no lowest version have no npm release to compare with. They are listed as not checked, never as up to date.
Get told when it changes
Inlinr follows the dependencies of your repositories and shows each release, advisory and deprecation as it is published, with the time you spent on each upgrade.
No card to start · no source code leaves your machine