Dependency Radar

Dependency Radar is a Node.js CLI tool that analyses a JavaScript or TypeScript project and produces a single, self-contained HTML report detailing its dependencies. It maps the full dependency tree, aggregates licence information, surfaces vulnerabilities, highlights outdated packages, and presents everything in a format that can be opened locally or shared with others. The goal is simple: give developers and teams a clear, structured view of what is actually inside their node_modules.

The idea grew out of working on large React applications and mono-repos where the dependency graph felt less like a list and more like a rainforest canopy. npm audit would show vulnerabilities. npm outdated would flag stale packages. Other tools could check licences or visualise graphs. But each tool answered a different question in isolation. I wanted one place where all of that context lived together, with a report that didn’t require a backend service or ongoing subscription just to read it.

The early versions of Dependency Radar were built by orchestrating existing tools and stitching their outputs together. Over time it became more deliberate. The CLI now performs lockfile-first analysis for npm, pnpm and Yarn, understands workspaces, can run fully offline, and generates both JSON and sanitised HTML output. A lot of effort has gone into making the report genuinely readable rather than just technically complete.

As the project matured, I began experimenting with collecting and enriching public package metadata in my own database. Much of the information about package maintenance, repository health and licence signals is publicly available, but impractical to fetch repeatedly during every local scan. That exploration led to a companion web service built with Next.js, Turso, S3, Convex and WorkOS, allowing enriched reports to be uploaded, stored and analysed over time.

Dependency Radar reflects how I tend to approach problems: start with a real frustration, build a practical solution, and then refine it until it feels considered from both a technical and user experience perspective.