diff_dependencies

io.github.salemalem/npmscan · Verify this server

Compare two snapshots of a package.json, package-lock.json (v1-v3), yarn.lock (classic or Berry) or pnpm-lock.yaml (e.g. before/after a PR; formats can differ) and report added, removed and changed packages. Lockfiles cover the full resolved graph, so transitive-only changes are caught; npm aliases are followed (`actualName`). Up to 100 added/changed packages are checked in detail. Ideal for a CI gate. Per added/changed package: - `installScriptIntroduced`: a preinstall/install/postinstall script the old version lacked — the shape of a compromised-maintainer release. `prepare` never runs on a registry install, so it is excluded; `installScriptKeysIntroduced` lists every new key, prepare included. - `sourceIntegrityChanged`: the same version now resolves to a different tarball URL or hash, or a bump moved to another host (ordinary bumps are not flagged). A same-version swap is `changeType: "source-swap"`. - `identityMismatch`: the tarball is a different package or version than declared; `tarballName`/`tarballVersion` say what really installs, and the vulnerability fields describe that. - `vulnerabilityDelta` (introduced/fixed/still-vulnerable/still-clean) plus the findings, each with isMalware. Project-level: `projectLifecycleChanges` diffs the project's own root install scripts (package.json only; a PR that only adds a root postinstall changes no dependency), and `overridesChanges` diffs overrides/resolutions/pnpm.overrides, from package.json or between two pnpm-lock.yaml files (removing one can let a vulnerable version back in). Both count toward `flaggedCount`. Read `comparisonNote` when the two snapshots differ in format. Install-script checks are presence-only; use analyze_install_script to see what a script does.