depsift reads an npm package — or your whole project — straight from the registry and hands back a graded report: real CVEs, the exact install script that runs on your machine, and every maintainer you'd be trusting. No install. No account. No AI.
One read-only command resolves the dependency graph from the registry and reports the facts. Nothing is installed, nothing touches disk.
Every resolved package matched against npm's own advisory database — the same data npm audit uses. No Snyk account, no AI that invents a vulnerability that isn't there.
Not "this package has an install script" — the exact command that will run on your machine, flagged when it reaches the network, pipes to a shell, or evals.
A zero-dependency semver resolver, parity-tested against node-semver, resolves every range the way npm does — so the package count matches what lands in node_modules.
Run it with no argument in any repo to grade your entire dependencies and devDependencies tree at once.
In project mode depsift parses your pnpm-lock.yaml, bun.lock, package-lock.json, or yarn.lock and audits the exact versions you installed — not a fresh re-resolve. Every parser is zero-dependency; --no-lock forces registry resolution.
How many maintainers you'd be trusting, how many packages are deprecated, and when the oldest dependency last shipped.
A clear A through F. A critical CVE or a malicious install script forces an F and exit code 2 — drop it straight into CI.
The thorough tools want an account, a wrapper around your installs, or an AI. depsift is one read-only command with nothing to install.
| depsift | npq | should-install | howfat | |
|---|---|---|---|---|
| Real CVEs (npm advisories) | yes | via Snyk | AI-guessed | — |
| Shows the literal install-script command | yes | — | — | — |
| Install-script danger scan | yes | — | — | — |
| npm-accurate resolution | yes | n/a | n/a | yes |
| Whole-project audit and grade | yes | — | AI | — |
| Runtime dependencies | 0 | 4 | 5 | 5 |
| Needs account / API key / AI | no | Snyk | yes (AI) | no |
| Deterministic | yes | yes | — | yes |
| Changes your workflow | no | npq install | no | no |
No flags, no config. Run it, read the report, move on.
Every npm install is a trust decision. Make it with the report in front of you.