depdiff GitHub

OPEN SOURCE. OFFLINE FIRST.

Small update.
Different behavior.

The version number changed. What else did?
Compare npm upgrades, uncover new capabilities, and get the evidence before you merge.

Explore a real diff Get started

Python 3.11No API keysNever executes package code

A small upgrade. A few important additions.

ACTUAL CLI OUTPUT, VISUALIZED
depdiff / upgrade reviewREAD-ONLY ANALYSIS
SYNTHETIC FIXTURES
$python3 -m depdiff npm demo-package 1.0.0 2.0.0 --fixtures-dir fixtures
The interactive comparison requires JavaScript.

Explore precomputed reports from harmless, local fixtures. No package is executed. A recommendation is evidence for review, not proof of maliciousness.

7capability categories
3shareable report formats
0package code executed
Your machine.Your code stays local.

01 BEYOND THE VERSION NUMBER

The diff your lockfile
doesn’t show.

A dependency can gain new powers without gaining a known CVE. depdiff makes those changes visible, one capability at a time.

Same package.
New permissions?

Scan JavaScript and lifecycle metadata for sensitive capabilities. See what was added, removed, or already there.

Read the detection rules

Read-only regex analysis, not runtime tracing.

PATTERN SPOTLIGHTHIGH

A package that can
start another process.

Child-process APIs can invoke shell commands and affect the host beyond the JavaScript runtime.

// Illustrative patternchild_process.exec(command);
process-child-process
+

Metadata tells a story, too.

Catch lifecycle scripts, dependency changes, and new main, bin, or exports entry points alongside source findings.

{ }

Your rules. Plain YAML.

Review and extend external detection rules. Set patterns, categories, severities, and reasons without changing the engine.

≠

A signal. Not a sentence.

Get deterministic scores and explainable reasons. Existing capability categories aren’t repeatedly scored as new risk.

02 READ. COMPARE. EXPLAIN.

From upgrade to understanding.

No black box. No package execution. Just a small, inspectable pipeline that turns two local versions into a review you can act on.

  1. 01

    Read both versions.

    Point to local npm fixtures. Validate names, versions, paths, and size limits before reading their contents.

    package.json + JavaScript
  2. 02

    Find the behavioral delta.

    Scan with YAML rules. Compare metadata and classify capabilities as added, removed, or unchanged.

    old → new → what changed
  3. 03

    Review the evidence.

    Get source locations, snippets, severity, and reasons. Share a terminal, JSON, or Markdown report.

    ok / review / block-recommended
two versions → static analysis → capability diff → your decision ALL LOCAL

03 A SECOND LOOK, WHERE IT COUNTS

Make “just an update”
an informed decision.

Built for the people who have to decide what ships. Use depdiff alongside your existing vulnerability scanners and update bots.

FOR MAINTAINERS

Review the upgrade, not thousands of lines.

Before merging a dependency-update PR, compare the two local versions. Attach the Markdown report so the next reviewer sees the same evidence.

PULL REQUEST REVIEWS
FOR SECURITY TEAMS

Look beyond known vulnerabilities.

Investigate newly visible process, environment, network, or install-script capabilities, even when there isn’t a published advisory.

SUPPLY-CHAIN TRIAGE
FOR LOCAL-FIRST DEVELOPERS

Keep the review on your machine.

Work offline with your own fixtures and detection rules. No account, remote service, API key, or source-code upload required.

OFFLINE ANALYSIS

04 TRY IT ON YOUR MACHINE

One command.
A clearer picture.

Clone the repository and compare the included harmless fixtures. Python 3.11.2, zero third-party dependencies, and no installation needed.

Read the full documentation
PYTHON 3.11.2
01 / GET THE SOURCE
git clone https://github.com/ashin-15/DepDiff.git
cd DepDiff
02 / COMPARE THE FIXTURES
python3 -m depdiff npm demo-package 1.0.0 2.0.0 \
  --fixtures-dir fixtures
03 / SHARE THE EVIDENCE
python3 -m depdiff npm demo-package 1.0.0 2.0.0 \
  --fixtures-dir fixtures --format markdown \
  --output reports/review.md
Included demos and tests work offline.

GOOD TO KNOW

A little more context.

Does this replace npm audit or Dependabot?+

No. Those tools help with known advisories and dependency updates. depdiff complements them with a version-to-version view of statically visible capabilities and metadata.

Is the website running a live package analysis?+

No. The interactive showcase displays saved reports generated by the real CLI against synthetic fixtures. To analyze your own local versions, use the Python CLI.

Can it download any package from npm?+

Not in the current MVP. You provide local package directories under the documented fixture layout. Registry retrieval, lockfile-wide analysis, and hosted scanning are not implemented.

Does an “ok” verdict mean a package is safe?+

No. It means the configured static analysis found no new capability signal under its policy. Regex analysis can miss runtime-only behavior and obfuscation, or match comments and strings. Every verdict is a recommendation for human review.

Know what changed.
Then decide.

Better dependency decisions start with better evidence.

Explore depdiff on GitHub