Lockfile Analyzer | npm and Yarn Duplicates

Lockfile analyzer for package-lock.json and yarn.lock. Counts packages, finds duplicate versions, git and tarball sources and install scripts. Free.

Also known as: package-lock.json analyzer · package lock viewer · yarn.lock analyzer · find duplicate packages in lockfile · npm lockfile duplicate versions · lockfile install scripts checker · how many dependencies in package-lock · package lock json size breakdown

javascript and typescript tools

developer utilities

analyzers

Lockfile Input

Lockfile Report

Package counts, duplicate versions and flagged sources will appear here.

About Lockfile Analyzer

A lockfile is the exact list of every package your project installs, and it is usually thousands of lines nobody reads. This analyzer reads a package-lock.json or a Yarn Classic yarn.lock and tells you what is in it: how many packages, which ones are installed at more than one version, where they came from, and which ones run code during install. Paste the file and the answer is on screen in a second.

Key Features

Reads package-lock.json lockfileVersion 1, 2 and 3 and Yarn Classic v1 yarn.lock
Counts total packages, unique names and unique name and version pairs
Lists every package installed at more than one version, with the folder and the packages that require each copy
Flags git, tarball and local file sources, plain http URLs and entries with no integrity hash
Lists packages that run install scripts, using the hasInstallScript flag npm records
Shows dev, optional and peer counts, registry hosts and the deepest node_modules nesting level
Filters every list by package name, and copies or downloads the full text report

Use Cases

Find out why a Next.js or React Native build pulled in three copies of the same library
Check a pull request that changed package-lock.json by 40,000 lines before approving it
Review which dependencies run postinstall scripts before turning on a locked-down CI runner
Confirm no dependency resolves to an internal mirror or an http URL before a SOC 2 audit
Audit a vendor repository you were handed for git dependencies and unpinned tarball links
Estimate how much a dedupe pass could save by seeing which names appear at the most versions

Supported Formats

package-lock.json v1

package-lock.json v2

package-lock.json v3

npm-shrinkwrap.json

yarn.lock (Classic v1)

.json

.lock

Related Keywords

package-lock.json analyzer

package lock viewer

yarn.lock analyzer

find duplicate packages in lockfile

npm lockfile duplicate versions

lockfile install scripts checker

how many dependencies in package-lock

package lock json size breakdown

Why does the same package show up at several versions in a lockfile?

Package managers install one copy of a name when every dependent accepts a shared version, and a second copy when two dependents need ranges that do not overlap. A project that depends on debug 4 while express asks for debug 2 ends up with both, the second one nested inside node_modules/express. That is correct behavior, not a bug, but each extra copy adds install size, a second set of security advisories to track, and sometimes real bugs when two copies of a singleton such as React or a plugin registry load at once. The duplicates list shows which dependents pull in each version, so you can upgrade the one that is behind, add an overrides entry, or run npm dedupe. The file never leaves your browser, so private package names stay private.

Privacy & Security

All processing happens locally in your browser. Your data never leaves your computer, ensuring complete privacy and security.

Liked this tool?

DevToolLab is free to use. If this analyzer saved you some time today, please consider supporting our work.

Buy us a coffee ☕

Frequently asked questions

What is Lockfile Analyzer used for?

Lockfile analyzer for package-lock.json and yarn.lock. Counts packages, finds duplicate versions, git and tarball sources and install scripts. Free.

Is Lockfile Analyzer free to use?

Yes. Lockfile Analyzer is completely free with no usage limits, and there is no paid tier required to use it.

Do I need an account to use Lockfile Analyzer?

No. Lockfile Analyzer works immediately in your browser with no signup, login, or email address required.

Related Tools

Word & Character Counter Online | Word Counter

Count words, characters, sentences, paragraphs and lines in your text. Analyze letter density and reading time instantly.

text tools

date and time tools

URL Parser | URL Analyzer Online

URL parser - extract protocol, host, path, query parameters, and hash fragments. Free, no signup, works instantly online.

hashing and checksum tools

url and link tools

User Agent Parser | Analyze Browser & OS Online Free

Parse and analyze user agent strings to detect browser, operating system, device type, and bot information. Essential for web debugging.

text tools

code formatters and minifiers

More Tools You Might Like

Pastebin Online | Share Code & Text Snippets Free

Popular

Share code snippets, logs, and text with a shareable link. Syntax highlighting for 30+ languages, expiration controls, and password protection for Pro users.

text tools

password and key generators

math calculators

utilities

Use Tool

URL Tracker & Link Shortener | Track Clicks

Popular

Create short, trackable URLs with detailed click analytics. Track visitor location, devices, referrers, and more. Password protection & QR codes included.

text tools

password and key generators

url and link tools

networking

Use Tool

Webhook Receiver & Inspector | Test HTTP Webhooks

Popular

Generate a unique URL to easily test, receive and inspect HTTP webhooks in real-time. View request headers, query parameters, JSON payloads, and more.