Alternatives
Products that do what Stack Graveyard does
Find deprecated npm packages before they haunt your prod app
- 1IV
Hi HN! Thanks for your attention to my post. It was a big challenge to run most of Node.js packages in browser, fast moreover. Virtual File system, resolve import/export. I got cold many times, depressions, burned out, yet still alive and finished it. Many guys helped me with an advice. Many users give a lot of positive feedback. There are 200,000 monthly unique users. I work full time now because of the freemium business model. To be honest - I am happy after many years of hard work.
2022 · playcode.io
- 2SW
2016 · npmdiscover.com
- 3SN
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com
- 4
- 5PD
2021 · pickbetterpack.com
- 6
- 7DB
Requirement: - Excellent feedback during development - Debugging with source maps Method: I'm using these scripts in package.json. "scripts": { "di": "node-inspector -d=7000 -p=8000 --save-live-edit --hidden node_modules/", "ds1": "babel ./server -d ./build/server -s -w", "ds2": "nodemon --watch ./build/server --delay 100ms --debug=7000 ./build/server/main.js" }, Then run "npm run ds1; npm run ds2; npm run di" Why: I took some time to put this together, after navigating all the tools out there. I personally find this to be "correct". Thought I'd…
2016
- 8DL
After yesterday's release of Deno with package.json support[0] some discussions about how Deno handles dependencies have been coming up again. Since Deno's inception, I've mostly been watching it from the sidelines, dabbling a bit with it, and mostly been considering it a fad that will die out sooner or later. Ultimately, with the new package.json support nothing really changed regarding the dependency management story of Deno. It's still as awful as ever. Prompted by some discussions, I decided I would try to test how easy it would be to mount a typo-domain supply chain attack. And as…
2023
- 9NI
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com
- 10AA
We've rolled out a feature for openbase.com that we think is a DX game changer for Node devs. Since the emergence of ECMA Script modules, it's been a continuous guessing game as to what kind of exports a package has. That's never really been discoverable without using a site like unpkg, or installing the package and inspecting package.json. Openbase now displays the ES Module support level (e.g. type of exports) on all of their package pages. We added this feature because our devs are some of the folks continually caught off guard by installing an NPM dependency only to find out it's…
2022
- 11DO
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com
- 12X2
I finally got tired of XKCD #2347 living rent-free in my head, so I built Stacktower: a tool that takes any real package’s dependency graph and turns it into an actual tower of bricks. Along the way I had to wrestle some surprisingly spicy problems. Full blog post here: https://stacktower.io The result is half visualization tool, half love letter to the chaos of modern dependency trees. Open-source, works with PyPI, Cargo, npm, and more. Code: https://github.com/matzehuels/stacktower
Dec 2025 · stacktower.io
- 13PD
2019 · diff.intrinsic.com
- 14
Block bad npm and pip packages. Before they download.
May 2026 · veln.sh
- 15NI
2023 · nixhub.io
- 16
- 17DB
My partner reviews a lot of P&IDs (piping and instrumentation diagrams) and the adjacent files involved (excel, docx, pdfs, acd/l5x, etc). In his company, these are usually done in Bluebeam. It's really hard to see the diff + keep track of all the revisions resulted by these iterations. They end up storing files like "rev3_final_redlined.pdf". We've been looking for something close to Github to do these reviews, but haven't found one easy enough for folks with no CLI experience to understand and use (happy to check out more tools if you know any). So I built withkord.com to help with…
Aug 2026 · withkord.com
- 18
- 19TD
Trusty - Search for an open source package to understand its trustworthiness based on activity, provenance, and more. Brought to you by the founders of projects such as Kubernetes and Sigstore. Hey, Luke here the CTO of stacklok. This is an early experimental preview of Trusty. We use statistical analysis to observe millions of packages and found that Malware typically follows certain patterns. We found this tool really useful to help understand the packages we our pulling into our software and wanted to share it with others. It's still early in and we have a lot more features that will be…
2023 · trustypkg.dev
- 20
- 21SI
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com
- 22
- 23
- 24
React Native & Expo Dependency Insights
May 2026 · package-intelligence.vercel.app
Ranked by how close each launch is in meaning, then by votes. Refine with a description →