package.json Analyzer

Any dependency whose version string is exactly "*" or "latest" — these tell npm/yarn/pnpm to always resolve to whatever the newest published version is at install time, which means your build can change behavior without any change to your own code.

That's a common copy-paste mistake — a package should generally live in exactly one of those sections. Having it in both doesn't break installs, but it's dead weight and a signal the package.json wasn't cleaned up after an edit.

No — this is a static, offline structural analysis of the package.json file itself (missing fields, unpinned versions, duplicate declarations, deprecated package names it recognizes). For actual vulnerability scanning against CVE databases, use `npm audit` or a dedicated tool like Snyk or Dependabot.

npm's registry and provenance/attestation features use the repository field to link a published package back to its source, and many supply-chain security tools treat its absence as a minor trust signal — it's a cheap addition with a small but real benefit.

No — parsing with JSON.parse and all the subsequent checks run entirely client-side in your browser.