Node Dependency Analyzer

How do I analyze my npm dependency tree and find duplicate package versions online?

Paste or drop your package.json and lockfile into AnyTool's Node Dependency Analyzer. It parses package-lock.json, yarn.lock and pnpm-lock.yaml in your browser to show the resolved tree, prod/dev counts, duplicate versions and heavy packages. Everything stays 100% in your browser - no upload, no signup.

Resolved transitive tree with exact installed versions from your real lockfile
Duplicate-version detection plus a best-case dedupe-savings estimate
Counts dashboard: direct vs transitive, prod vs dev, peer and optional
100% in your browser - no upload, no signup, works offline

What is

A browser tool that parses an npm, yarn or pnpm lockfile to reveal the resolved dependency tree, exact installed versions, prod and dev counts, duplicate versions and the heaviest packages by dependency footprint.

Developer Tools

Related terms

package-lock.jsonTransitive dependenciesDuplicate versionsDependency tree

Frequently Asked Questions

The whole analysis runs client-side in your browser. AnyTool never sends your package.json, lockfile or dependency list to any server, registry or CDN. It works offline, so even a private monorepo lockfile stays on your device.

No upload at all - your package.json and lockfile are parsed entirely in your browser and never sent anywhere.

Because it parses the actual lockfile rather than only package.json ranges, it sees the exact resolved versions installed. It groups every package that appears at multiple versions, shows who requires each one, and estimates how many install nodes a full dedupe could remove.

It reads the resolved versions in your lockfile and lists every package installed at more than one version.

An offline tool cannot fetch live install or bundle sizes, since those are computed against the npm registry. To stay fully private, it ranks the heaviest packages by subtree node count - how many dependencies each one drags in - which is the honest offline measure of weight.

No - exact install and bundle sizes need an npm-registry call, so it ranks heaviness by subtree node count instead.

Paste or drop any supported lockfile and the format is detected automatically. It handles package-lock.json versions 1, 2 and 3, classic and Berry yarn.lock, and pnpm-lock.yaml. Large monorepo lockfiles are parsed in a Web Worker so the interface stays responsive.

package-lock.json v1/v2/v3, yarn.lock classic and Berry, and pnpm-lock.yaml, with the format auto-detected.

Detailed Explanation

Technical Details

Resolving the dependency tree from a lockfile

The Node Dependency Analyzer parses the lockfile itself rather than just package.json, so it reads the exact versions npm, yarn or pnpm actually installed. From those resolved entries it reconstructs the full transitive tree and accurate counts. Format is auto-detected across package-lock.json v1/v2/v3, classic and Berry yarn.lock, and pnpm-lock.yaml.

Reads resolved versions, not just declared semver ranges
Supports package-lock.json, yarn.lock classic + Berry, and pnpm-lock.yaml
Large lockfiles are parsed off the main thread in a Web Worker

Use Cases

Duplicate-version detection and dedupe savings

Because it works from resolved versions, the tool lists every package present at more than one version - the leading cause of node_modules bloat that package.json-only tools cannot see. Each duplicate group shows the versions, who requires each, and the subtree node counts, plus a best-case estimate of how many install nodes a full dedupe could remove.

Groups packages installed at multiple resolved versions
Shows requiredBy chains and per-version subtree node counts
Estimates redundant install nodes removable by deduping

Limitations

Honest limits of fully offline analysis

Running entirely in the browser means no npm-registry calls, so exact install and bundle sizes, outdated checks and CVE data are not available - those require a network source. Heavy-package ranking therefore uses subtree node count as the honest offline weight. With no lockfile, only declared direct dependencies and ranges are shown, with no transitive tree or duplicate detection.

No live install/bundle sizes, outdated or CVE data without a network call
Heaviness ranked by subtree node count, not registry size
package.json-only input is a degraded mode with no transitive resolution

AnyTool Node Dependency Analyzer vs typical online alternatives
Capability	AnyTool	Typical alternative
Privacy / no upload	Yes - 100% client-side	Often fetches from npm registry
Price	Free	Freemium/paywall
Reads real lockfile (resolved tree)	Yes - npm, yarn, pnpm	Often package.json-only or registry-resolved
Duplicate-version detection	Yes - with dedupe estimate	Rarely (needs resolved versions)
Works fully offline	Yes	No - server or registry calls

Exact install/bundle sizes and CVE data are intentionally omitted to keep the tool fully offline.