Alternatives
Products that do what PkgDiet does
Catch unused, deprecated, bloated npm deps + alternatives
- 1IV
Hi HN! Thanks for your attention to my post. It was a big challenge to run most of Node.js packages in browser, fast moreover. Virtual File system, resolve import/export. I got cold many times, depressions, burned out, yet still alive and finished it. Many guys helped me with an advice. Many users give a lot of positive feedback. There are 200,000 monthly unique users. I work full time now because of the freemium business model. To be honest - I am happy after many years of hard work.
2022 · playcode.io
- 2NA
Colin here, creator of Nub. I’ve had the general shape of this in mind for years. Nub runs your code with stock `node`, augmented with a `--require` preload hook[0] that adds a transpiler (oxc-powered, packaged as a Node-API add-on), registers a module resolution hook[1], and injects polyfills as needed for APIs like `Worker`, `Temporal`, etc. All purely additive, your code ultimately runs using Node’s actual engine & stdlib implementations. [0] https://nodejs.org/api/cli.html#-require-module [1]…
Jun 2026 · github.com
- 3WM
2025 · npmjs.com
- 4
Find deprecated npm packages before they haunt your prod app
May 2026 · stackgraveyard.dev
- 5DO
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com
- 6PD
2021 · pickbetterpack.com
- 7
- 8SW
2016 · npmdiscover.com
- 9
- 10NI
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com
- 11SN
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com
- 12DL
After yesterday's release of Deno with package.json support[0] some discussions about how Deno handles dependencies have been coming up again. Since Deno's inception, I've mostly been watching it from the sidelines, dabbling a bit with it, and mostly been considering it a fad that will die out sooner or later. Ultimately, with the new package.json support nothing really changed regarding the dependency management story of Deno. It's still as awful as ever. Prompted by some discussions, I decided I would try to test how easy it would be to mount a typo-domain supply chain attack. And as…
2023
- 13DB
Requirement: - Excellent feedback during development - Debugging with source maps Method: I'm using these scripts in package.json. "scripts": { "di": "node-inspector -d=7000 -p=8000 --save-live-edit --hidden node_modules/", "ds1": "babel ./server -d ./build/server -s -w", "ds2": "nodemon --watch ./build/server --delay 100ms --debug=7000 ./build/server/main.js" }, Then run "npm run ds1; npm run ds2; npm run di" Why: I took some time to put this together, after navigating all the tools out there. I personally find this to be "correct". Thought I'd…
2016
- 14SI
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com
- 15LC
Debugging is hard for LLMs, because they primarily depend on source code, and they don't have access to runtime state. I spent countless hours debugging code, and the only way I found LLMs useful for that, is to ask them to add log lines. That's annoying, because it pollutes my code and adds unnecessary diffs. So we made an MCP server that solve this problem. It gives MCP clients (like Claude Code) access to a NodeJS inspector, so they can: 1. set breakpoints 2. step in, step out, continue 3. fetch the current execution location 4. read console output 5. run JS using eval To try: 1. run a…
2025 · github.com
- 16
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh
- 17AA
We've rolled out a feature for openbase.com that we think is a DX game changer for Node devs. Since the emergence of ECMA Script modules, it's been a continuous guessing game as to what kind of exports a package has. That's never really been discoverable without using a site like unpkg, or installing the package and inspecting package.json. Openbase now displays the ES Module support level (e.g. type of exports) on all of their package pages. We added this feature because our devs are some of the folks continually caught off guard by installing an NPM dependency only to find out it's…
2022
- 18
- 19
- 20
- 21NJ
2015 · github.com
- 22IB
2022 · npm.kasper.io
- 23DP
2015 · github.com
- 24
Clean Xcode, node_modules & developer junk in seconds.
Aug 2026 · devboxcleaner.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →