See the real cost of your node_modules — size, security severity, and days since last publish. One command, one table.
Real output from running npx node-weight on an actual project
┌─────────────────────────┬──────────┬──────────┬───────────────┐ │ Package │ Size │ Security │ Last Updated │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ commander │ 182.0 KB │ ✓ clean │ 683 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ signal-exit │ 75.2 KB │ ✓ clean │ 978 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ ora │ 68.2 KB │ ✓ clean │ 424 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ emoji-regex │ 47.1 KB │ ✓ clean │ 2584 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ cli-table3 │ 45.1 KB │ ✓ clean │ 689 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ chalk │ 43.3 KB │ ✓ clean │ 205 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ @colors/colors │ 38.6 KB │ ✓ clean │ 1510 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ cli-spinners │ 31.4 KB │ ✓ clean │ 859 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ string-width │ 14.5 KB │ ✓ clean │ 1651 days ago │ ├─────────────────────────┼──────────┼──────────┼───────────────┤ │ get-east-asian-width │ 14.2 KB │ ✓ clean │ 42 days ago │ └─────────────────────────┴──────────┴──────────┴───────────────┘ 21 packages | 614.9 KB | 0 vulnerabilities
| Column | What it shows | Why it matters |
|---|---|---|
| Size | Total disk size of the installed package directory | Pinpoint bloat fast — find which dep is eating your 300 MB node_modules |
| Security | npm audit severity (critical / high / moderate / low / clean) | Know at a glance which packages have active CVEs — without parsing npm audit JSON |
| Last Updated | Days since the package was last published to npm | Unmaintained packages are supply chain risk — a package last updated 2,584 days ago is a signal |
Scans node_modules/ in the current directory. No config file, no package.json parsing beyond what's installed.
Calls the npm registry API in parallel to get each package's publish date. Runs npm audit once to get security severity per package.
Sorts by size descending. Shows total row at the bottom. Color-codes security severity: red for critical/high, yellow for moderate, green for clean.
Other tools cover one dimension. node-weight covers all three.
Stale packages (1000+ days) are soft supply chain risk. Not necessarily vulnerable today, but a target for account takeovers. Know which ones you're carrying.
Slow Docker builds, bloated Lambdas, long cold starts — they often trace back to one massive transitive dependency. Size column surfaces it in seconds.
Instead of running npm audit + du -sh + checking registry.npmjs.org by hand, you get everything in a single table from one npx node-weight.
npx node-weight works without a global install. Nothing added to your package.json. Run it once and forget it, or add it to your CI pipeline.
Zero install. Works on any Node.js project with a node_modules directory. Free and open source.
Run in your project root. Requires Node.js ≥ 18 and an existing node_modules directory.
Then run node-weight anywhere, or node-weight /path/to/project to audit a different directory.
Add to your CI pipeline for a regular dependency health check. Exits 0 always — informational, not blocking.
Also check out mcp-devutils — 45 developer utilities for Claude Desktop & Cursor.