dependency-cruiser 18.7.1

Why

• warnSuspicious behaviour

  Difference between manifest and package.json found: devDependencies: yarn: Manifest("1.22.22"), package.json("None") @types/node: Manifest("^26.6.6"), package.json("None") @babel/preset-typescript: Manifest("^7.29.7"), package.json("None") esbuild: Manifest("0.28.2"), package.json("None") @vue/compiler-sfc: Manifest("3.5.44"), package.json("None") c8: Manifest("12.0.0"), package.json("None") @swc/core: Manifest("1.16.21"), package.json("None") ajv: Manifest("8.20.0"), package.json("None") proxyquire: Manifest("2.1.3"), package.json("None") upem: Manifest("11.0.2"), package.json("None") vue-template-compiler: Manifest("2.7.16"), package.json("None") husky: Manifest("9.1.7"), package.json("None") coffeescript: Manifest("2.7.1"), package.json("None") svgo: Manifest("4.1.0"), package.json("None") prettier: Manifest("3.9.10"), package.json("None") typescript: Manifest("^6.0.3"), package.json("None") clean-pkg-json: Manifest("2.0.0"), package.json("None") oxlint: Manifest("1.90.0"), package.json("None") npm-run-all2: Manifest("9.0.4"), package.json("None") @babel/plugin-transform-modules-commonjs: Manifest("^7.29.7"), package.json("None") normalize-newline: Manifest("5.0.0"), package.json("None") @babel/core: Manifest("^7.29.7"), package.json("None") svelte: Manifest("5.57.3"), package.json("None") @types/prompts: Manifest("2.4.9"), package.json("None") mocha: Manifest("12.0.3"), package.json("None") symlink-dir: Manifest("^7.1.0"), package.json("None") lint-staged: Manifest("17.6.0"), package.json("None") scripts: format:check: Manifest("prettier --log-level warn --check "src/**/*.?js" "configs/**/*.?js" "tools/**/*.mjs" "bin/*" "types/*.d.mts" "test/**/*.spec.{cjs,js}" "test/**/*.{spec,utl}.mjs""), package.json("None") scm:push:gitlab-mirror:commits: Manifest("git push gitlab-mirror"), package.json("None") update-dependencies: Manifest("npm-run-all --node-run upem:update upem:install build:clean build lint:eslint:clear-caches lint:fix depcruise test:cover"), package.json("None") test: Manifest("LANG=en_US.UTF-8 NODE_OPTIONS=--no-warnings NO_COLOR=1 mocha"), package.json("echo see github for test, build and analysis scripts") scm:push:github: Manifest("run-p --aggregate-output scm:push:github:*"), package.json("None") lint: Manifest("npm-run-all --parallel --aggregate-output --node-run lint:eslint format:check lint:types"), package.json("None") depcruise:focus: Manifest("node ./bin/dependency-cruiser.mjs src bin test configs types tools --progress --no-cache --output-type text --focus"), package.json("None") test:cover: Manifest("LANG=en_US.UTF-8 NODE_OPTIONS=--no-warnings NO_COLOR=1 c8 mocha"), package.json("None") depcruise:graph:doc:fmt-types: Manifest("cd types && node ../bin/dependency-cruiser.mjs . --output-type dot | dot -T svg | tee overview.svg | ../bin/wrap-stream-in-html.mjs > overview.html && cd -"), package.json("None") prepack:format-src-with-tabs: Manifest("prettier --log-level warn --write --use-tabs bin src types configs"), package.json("None") lint:types: Manifest("npm-run-all --node-run lint:types:tsc lint:types:lint"), package.json("None") scm:push:bitbucket-mirror: Manifest("run-p --aggregate-output scm:push:bitbucket-mirror:*"), package.json("None") test:load:cached: Manifest("hyperfine --warmup 3 --runs 30 "bin/dependency-cruiser.mjs src bin test configs types tools --ignore-known --cache node_modules/.cache/dependency-cruiser/load-cached --no-progress""), package.json("None") version: Manifest("npm-run-all --node-run build depcruise:graph:doc scm:stage"), package.json("None") depcruise: Manifest("node ./bin/dependency-cruiser.mjs src bin test configs types tools --ignore-known"), package.json("None") lint:eslint: Manifest("oxlint bin/dependency-cruiser.mjs bin src test configs tools/**/*.mjs"), package.json("None") build: Manifest("make build"), package.json("None") depcruise:graph:doc:json: Manifest("node ./bin/dependency-cruiser.mjs bin src test --output-type json --output-to node_modules/.cache/tmp_graph_deps.json --progress"), package.json("None") test:load:cached:short: Manifest("hyperfine --warmup 1 --runs 5 "bin/dependency-cruiser.mjs src bin test configs types tools --ignore-known --cache node_modules/.cache/dependency-cruiser/load-cached --no-progress""), package.json("None") scm:push:bitbucket-mirror:tags: Manifest("git push --tags bitbucket-mirror"), package.json("None") depcruise:graph:doc:samples: Manifest("sh tools/generate-samples.sh"), package.json("None") prepare: Manifest("husky"), package.json("None") depcruise:baseline: Manifest("node ./bin/dependency-cruiser.mjs src bin test configs types tools --baseline --progress"), package.json("None") postpack: Manifest("git restore package.json bin src types configs"), package.json("None") lint:types:lint: Manifest("oxlint types/*.d.mts"), package.json("None") lint:types:tsc: Manifest("tsc --project types/tsconfig.json"), package.json("None") check:full: Manifest("npm-run-all --node-run check test:glob"), package.json("None") depcruise:graph:mermaid: Manifest("node ./bin/dependency-cruiser.mjs bin src --include-only ^src/ --collapse 2 --output-type mermaid"), package.json("None") depcruise:report: Manifest("node ./bin/dependency-cruiser.mjs src bin test configs types --output-type err-html --config configs/.dependency-cruiser-show-metrics-config.mjs --output-to dependency-violations.html"), package.json("None") scm:push:gitlab-mirror: Manifest("run-p --aggregate-output scm:push:gitlab-mirror:*"), package.json("None") test:load:short: Manifest("hyperfine --warmup 1 --runs 5 "bin/dependency-cruiser.mjs src bin test configs types tools --ignore-known --no-cache --no-progress""), package.json("None") upem:install: Manifest("npm install"), package.json("None") build:clean: Manifest("make clean"), package.json("None") check: Manifest("npm-run-all --node-run build lint depcruise test:cover"), package.json("None") upem:update: Manifest("npm outdated --json --long | upem | pbcopy && pbpaste"), package.json("None") scm:push:github:tags: Manifest("git push --tags"), package.json("None") scm:push:gitlab-mirror:tags: Manifest("git push --tags gitlab-mirror"), package.json("None") depcruise:graph:doc:fmt-archi: Manifest("./bin/depcruise-fmt.mjs -T archi -f - node_modules/.cache/tmp_graph_deps.json | dot -T svg -Gordering=in -Grankdir=TD | tee doc/real-world-samples/dependency-cruiser-archi-graph.svg | node bin/wrap-stream-in-html.mjs > docs/dependency-cruiser-archi-graph.html"), package.json("None") depcruise:report:view: Manifest("node ./bin/dependency-cruiser.mjs src bin test configs types --output-type err-html --config configs/.dependency-cruiser-show-metrics-config.mjs --output-to - | browser"), package.json("None") test:load: Manifest("hyperfine --warmup 3 --runs 30 "bin/dependency-cruiser.mjs src bin test configs types tools --ignore-known --no-cache --no-progress""), package.json("None") scm:push:github:commits: Manifest("git push"), package.json("None") scm:push: Manifest("run-p --aggregate-output scm:push:*"), package.json("None") depcruise:graph:view:diff: Manifest("node ./bin/dependency-cruiser.mjs bin src test --prefix vscode://file/$(pwd)/ --config configs/.dependency-cruiser-unlimited.mjs --output-type dot-webpage --progress cli-feedback --affected | browser"), package.json("None") prepack: Manifest("npm-run-all --node-run prepack:format-src-with-tabs prepack:clean-pkg-json"), package.json("None") prepack:clean-pkg-json: Manifest("clean-pkg-json --dry | jq '.scripts = {test: "echo see github for test, build and analysis scripts"}' | jq '.type = "module"' > smaller-package.json && mv smaller-package.json package.json && prettier --log-level warn --write --use-tabs package.json"), package.json("None") lint:eslint:fix: Manifest("oxlint bin/dependency-cruiser.mjs bin src test configs tools/**/*.mjs --fix"), package.json("None") depcruise:graph:doc:fmt-detail: Manifest("./bin/depcruise-fmt.mjs -T dot -f - node_modules/.cache/tmp_graph_deps.json | dot -T svg | tee doc/real-world-samples/dependency-cruiser-without-node_modules.svg | node bin/wrap-stream-in-html.mjs > docs/dependency-cruiser-dependency-graph.html"), package.json("None") scm:push:bitbucket-mirror:commits: Manifest("git push bitbucket-mirror"), package.json("None") upem-outdated: Manifest("npm outdated --json --long | upem --dry-run"), package.json("None") scm:stage: Manifest("git add ."), package.json("None") test:u: Manifest("LANG=en_US.UTF-8 NODE_OPTIONS=--no-warnings NO_COLOR=1 mocha --grep "^\[[U]\]""), package.json("None") depcruise:reaches: Manifest("node ./bin/dependency-cruiser.mjs src bin test configs types tools --progress --no-cache --config configs/.dependency-cruiser-unlimited.mjs --output-type text --reaches"), package.json("None") depcruise:graph:doc: Manifest("npm-run-all --node-run depcruise:graph:doc:json --parallel depcruise:graph:doc:fmt-* depcruise:graph:doc:samples"), package.json("None") lint:types:fix: Manifest("oxlint --fix types/*.d.mts"), package.json("None") depcruise:graph:doc:fmt-dir: Manifest("./bin/depcruise-fmt.mjs -T ddot -f - node_modules/.cache/tmp_graph_deps.json | dot -T svg -Grankdir=TD | tee doc/real-world-samples/dependency-cruiser-dir-graph.svg | node bin/wrap-stream-in-html.mjs > docs/dependency-cruiser-dir-graph.html"), package.json("None") depcruise:graph:doc:fmt-schema: Manifest("cd tools/schema && node ../../bin/dependency-cruiser.mjs . --output-type dot | dot -T svg | tee ../overview.svg | node ../../bin/wrap-stream-in-html.mjs > ../../docs/schema-overview.html && cd -"), package.json("None") lint:eslint:clear-caches: Manifest("rm -rf node_modules/.cache/eslint/"), package.json("None") test:glob: Manifest("set -f && test "`bin/dependency-cruiser.mjs --no-config test/extract/__mocks__/gather-globbing/packages/**/src/**/*.js | grep "no dependency violations found"`" = "✔ no dependency violations found (6 modules, 0 dependencies cruised)""), package.json("None") lint:fix: Manifest("npm-run-all --node-run lint:eslint:fix format lint:types:fix"), package.json("None") test:i: Manifest("LANG=en_US.UTF-8 NODE_OPTIONS=--no-warnings NO_COLOR=1 mocha --grep "^\[[I]\]""), package.json("None") depcruise:all: Manifest("node ./bin/dependency-cruiser.mjs src bin test configs types tools"), package.json("None") format: Manifest("prettier --log-level warn --write "src/**/*.?js" "configs/**/*.?js" "tools/**/*.mjs" "bin/*" "types/*.d.mts" "test/**/*.spec.{cjs,js}" "test/**/*.{spec,utl}.mjs""), package.json("None") depcruise:graph:mermaid:diff: Manifest("node ./bin/dependency-cruiser.mjs bin src test types tools --config configs/.dependency-cruiser-unlimited.mjs --output-type mermaid --affected $SHA"), package.json("None") depcruise:explain: Manifest("node ./bin/dependency-cruiser.mjs src bin test configs types tools --output-type err-long --progress none"), package.json("None") test:e: Manifest("LANG=en_US.UTF-8 NODE_OPTIONS=--no-warnings NO_COLOR=1 mocha --grep "^\[[E]\]""), package.json("None") depcruise:graph:view: Manifest("node ./bin/dependency-cruiser.mjs bin src --prefix vscode://file/$(pwd)/ --config configs/.dependency-cruiser-show-metrics-config.mjs --output-type dot-webpage --progress cli-feedback --highlight "$(watskeburt main)" | browser"), package.json("None")

• warnRelease cooldown

  Published less than an hour ago, inside the 7-day cooldown. Most malicious releases are pulled within hours of publication, so a version this new has not yet had time to be caught.

What the code does

On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.

Other checked releases

• 18.7.1warn1 Nov 2026
• 18.7.0warn19 Oct 2026
• 18.6.0warn11 Oct 2026