Package Lock Analyzer

The analyzer shows: total package count (direct + transitive), dev-only dependency count, duplicate packages (same package with multiple versions), an estimated bundle size for production dependencies, and a license breakdown across all packages.

Transitive (indirect) dependencies are packages that your direct dependencies depend on — not listed in your package.json but required for them to work. For example, if you install React, it transitively depends on scheduler and js-tokens. These are often the majority of packages in node_modules.

Duplicate packages (same package, different versions) appear when two of your dependencies require incompatible versions of the same package. npm installs both versions in separate locations in node_modules. This increases bundle size. Tools like npm dedupe can sometimes flatten these.

lockfileVersion indicates the format of your package-lock.json. Version 1 is from npm 5/6. Version 2 is from npm 7 (adds backwards-compatible packages field). Version 3 is the current format (npm 7+ with packages only). This tool supports v1, v2, and v3.

Yes — always commit package-lock.json for applications. It ensures every developer and CI run gets exactly the same package versions, preventing 'works on my machine' issues. For libraries (npm packages you publish), you typically omit package-lock.json from the published artifact but still commit it to your repo.

Audit large transitive deps with 'npm ls'. Remove unused packages with 'npx depcheck'. Consider replacing heavy packages (moment → date-fns, lodash → native methods). Use 'npm dedupe' to flatten duplicates. Tools like bundlephobia.com show the size cost of each package.