NPM LOCKFILE DUPLICATES CHECK · RUNS IN YOUR BROWSER

Why is node_modules installing the same package five times?

Paste your package-lock.json and get every package that resolves to more than one version, the dependant that pulls in each copy, and a fix: same-major copies that npm dedupe can usually collapse are listed first, then cross-major copies that need an upgrade or an overrides entry.

Nothing is uploaded. The lockfile you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own. A lockfile has versions, not sizes, so it counts copies; it does not measure bytes.

Paste your lockfile

Paste a package-lock.json above and click Find duplicates.

Want it as a CI gate?

Same logic, zero dependencies, one file plus the shared module. It reads one local file and nothing else:

node dupes-check.mjs                          # audit ./package-lock.json
node dupes-check.mjs --max 25                 # exit 1 if more than 25 packages are duplicated
node dupes-check.mjs --max-same-major 0       # exit 1 if npm dedupe would still remove something
node dupes-check.mjs --ignore react --no-dev  # skip packages / devDependencies
node dupes-check.mjs --json                   # machine-readable

Get dupes-check.mjs and dupes.mjs from the repo. Node 18+, nothing to install, no network calls.

Common questions

What is a duplicate package in package-lock.json?

The same package installed at more than one version, usually one copy at the top of node_modules and others nested under the packages that need a different version. Each extra copy costs disk space, install time and, in a front-end build, bundle size.

Can npm dedupe remove them?

Often, when the copies share a major version. Running npm dedupe lets npm move a compatible version up the tree so one copy satisfies several dependants. Copies at different major versions cannot be merged that way: the dependant has to be upgraded, or you can force one version with an overrides entry in package.json and test that nothing breaks.

Does this tool upload my package-lock.json?

No. The lockfile is read in this page and never leaves your device. The page makes no network calls, and the CLI reads one local file.

Does it measure how many bytes the duplicates cost?

No. A lockfile records versions, not sizes, so the report counts extra copies and shows who requires each one. Use your bundler's analyser to see the byte cost of the ones that reach a browser bundle.

Is a duplicate always a problem?

No. Many are harmless, and a few matter, for example two copies of a library that keeps global state, or two copies of a UI framework in one bundle. The report is a list to review, not a finding that anything is broken.

More: how to remove duplicate packages from node_modules