lacspace-deps

Dependency, licence & SBOM auditor as a CI gate.

terminal

npx lacspace-deps

What it does

Everything, in one command

Most projects don't really know what they ship. lacspace-deps reads package.json, the lockfile and your local node_modules and answers the questions that matter for supply-chain hygiene: are these licences allowed, what's bloating node_modules, which libraries are installed twice, what's declared but never imported (or imported but never declared), and — opt-in — what's fallen behind on the registry. Everything except the outdated check is pure filesystem work with no telemetry.

Features

What's inside

Licence policy gate

Classify every package and fail on a GPL-*/AGPL-* with --allow/--deny.

Install-size report

Heaviest packages by real on-disk bytes + file counts, with a gzip estimate.

Duplicate detection

Packages installed at multiple versions, with where each copy lives.

Unused & missing

Declared-but-never-imported and imported-but-undeclared deps from a source scan.

Outdated (opt-in)

Registry latest-version diff flagging majors behind; the only online feature.

CI-ready output

Human, --json or -f md; non-zero exit on --fail-on categories.

Zero-dep & local

Keyless, no account, no telemetry; Node built-ins only.

SBOM export

Generate a CycloneDX 1.5 or SPDX 2.3 JSON bill of materials for your whole dependency tree.

.depsrc.json policy

Keep allow/deny, max-severity and fail-on gates in the repo; auto-discovered, CLI overrides.

Max-severity licence gate

Fail on anything stricter than a chosen category, no glob lists needed.

Package-URL (purl) ids

Every SBOM component carries a standard pkg:npm/... purl and bom-ref.

How to use

Copy, paste, done

Real commands and snippets — from a one-liner to the typed library.

Full audit

terminal

npx lacspace-deps

Health score + every section for the current project.

Enforce a licence policy in CI

terminal

npx lacspace-deps --allow "MIT,ISC,Apache-2.0,BSD-*" --deny "GPL-*,AGPL-*"

Exits 1 on a copyleft dependency.

Dead + undeclared deps

terminal

npx lacspace-deps unused --fail-on unused,missing

Gate the build on hygiene.

What's bloating node_modules

terminal

npx lacspace-deps size --top 15 --gzip

Heaviest packages by install size.

Duplicate versions

terminal

npx lacspace-deps duplicates

Find the same library installed twice.

Markdown for a CI summary

terminal

npx lacspace-deps -f md > deps-report.md

Drop into a job summary.

CycloneDX SBOM

terminal

npx lacspace-deps sbom --format cyclonedx > bom.json

Standards-compliant CycloneDX 1.5 JSON.

SPDX SBOM

terminal

npx lacspace-deps sbom ./my-app --format spdx > sbom.spdx.json

SPDX 2.3 with purl externalRefs + DESCRIBES relationships.

Severity gate in CI

terminal

npx lacspace-deps --max-severity weak-copyleft --fail-on license

Exit 1 on any strong-copyleft or unknown licence.

Committed policy

terminal

npx lacspace-deps --policy ./.depsrc.json

Allow/deny + maxSeverity + failOn from one JSON file.

Good for

What people build with it

✓ CI licence-compliance gate

✓ Pre-release supply-chain audit

✓ Trim node_modules bloat (size + duplicates)

✓ Catch dead/phantom dependencies during refactors

Start now

Run lacspace-deps today

Free, open-source, no API keys. It's a CLI and a typed library.

terminal

npx lacspace-deps

npm ↗Source ↗All tools →