Paste a lockfile or excerpt to list the recognized packages and resolved versions. Use the duplicate-version report to find packages recorded at more than one version.
Runs locally in your browserThis page reads package-lock.json, pnpm-lock.yaml or yarn.lock in the browser and reports what the lockfile resolves: how many entries it pins, how many different names it contains, and which names are pinned to more than one version. Nothing is installed, and no registry is contacted.
Paste the file or a section of it and press Analyze locally. The report lists the detected format, the resolved entry count and the duplicate names; the table below it prints the name, version and source of each entry, and Copy puts the JSON report on the clipboard.
An npm lockfile is recognized from its lockfileVersion, packages or dependencies fields. Version 2 and 3 files are read from the packages map: every key that contains node_modules/ becomes one entry, so the root project entry ("") is not counted and a nested path such as node_modules/foo/node_modules/bar is listed under bar. Version 1 files are read from the dependencies map instead.
A pnpm lockfile is recognized from its lockfileVersion or packages section, and each /name@version key becomes an entry, including scoped names such as /@babel/core@7.24.0. A Yarn classic lockfile is recognized from its selector blocks: the version line is paired with every selector in the key, so a line that maps two ranges to one version produces two entries, and quoted scoped selectors such as "@scope/pkg@^0.4.0" are unquoted before the name is taken.
One entry is one resolution, not one distinct package: an npm entry is one path in the tree and a Yarn entry is one selector, so a dependency installed at two nesting levels appears twice. The duplicate count works per name across versions: a name that is pinned to two different versions is reported, while the same version reached from two selectors is not.
The JSON report contains format, resolvedPackages, uniqueNames and namesWithMultipleVersions, so it can be diffed between two branches. The table prints at most 500 rows and says so when the lockfile is larger; the metrics and the report always count every entry.
Nothing is fetched: the page does not contact npm, the pnpm registry or Yarn, so it cannot verify that a version exists, that an integrity hash matches, or that a package is deprecated or affected by an advisory. An entry without a version field is printed as unresolved, which usually means the lockfile was edited by hand or written by a different tool.
Malformed JSON stops the analysis with a hint and the position where parsing failed; a YAML file that is not a pnpm lockfile, and a JSON file with no recognized package section, both answer with the same message instead of an empty table. Copying before an analysis returns a hint rather than an empty clipboard.