Dependency Auditing Tools Compared: depcheck vs knip vs npm-check

When maintaining modern JavaScript projects, keeping dependencies lean and relevant is critical for performance, security, and long-term maintainability. Three popular tools—depcheck, knip, and npm-check—help identify unused or problematic packages, but they differ significantly in scope, architecture, and workflow integration. Let’s examine how each works under real-world conditions.

🔍 Core Functionality: What Each Tool Actually Checks

depcheck focuses exclusively on detecting unused dependencies listed in package.json. It parses your source code (JavaScript, TypeScript, JSX, etc.) and compares required modules against declared dependencies. If a package is in dependencies or devDependencies but never imported or required, it flags it.

# Basic usage
npx depcheck

It does not check for missing dependencies, outdated versions, or interactive updates.

knip takes a broader approach: it identifies unused files, exports, and dependencies, plus missing dependencies and unlisted binaries. It scans your entire codebase—including configuration files—and validates that everything referenced is properly declared.

# Basic usage
npx knip

For example, if you use eslint in a script but forget to list it in devDependencies, knip will catch it.

npm-check emphasizes interactive dependency management: it shows which packages are outdated, unused, or missing, and lets you selectively update or remove them via an interactive TUI.

# Check for issues
npx npm-check

# Interactive update mode
npx npm-check -u

Unlike the others, npm-check provides a visual interface for decision-making, making it beginner-friendly but less suited for CI pipelines.

🧪 Detection Accuracy: False Positives and Edge Cases

All three tools can produce false positives, but their handling differs.

depcheck may miss dynamically required modules (e.g., require(someVar)) or dependencies used only in non-JS files (like Webpack configs). You can configure it with --ignores or custom parsers:

// .depcheckrc
{
  "ignores": ["@types/*", "typescript"]
}

knip reduces false positives by supporting custom entry points and project types. For example, it understands that next uses next.config.js and won’t flag next as unused:

// knip.jsonc
{
  "$schema": "https://unpkg.com/knip@latest/schema.json",
  "entry": ["src/index.ts", "next.config.js"]
}

It also checks for unused TypeScript exports and dead files—features the others lack.

npm-check often flags packages as unused if they’re only used in build scripts or CLI contexts (e.g., prettier called via npm run format). It doesn’t deeply analyze source code structure, relying instead on static string matching of require/import statements.

⚙️ Integration into Developer Workflows

depcheck is designed for automation. Its JSON output integrates cleanly into CI:

# Fail CI if unused deps found
npx depcheck --json | jq -e '.dependencies | length == 0'

No interactive mode exists—it’s purely a linter.

knip supports both CI and local development. It offers machine-readable output (--reporter json) and can auto-fix some issues (e.g., removing unused files):

# Run in CI with strict exit code
npx knip --fail-on-unused

Its plugin system supports frameworks like Next.js, Remix, and Vite out of the box.

npm-check is primarily a local development tool. The interactive update mode (-u) modifies package.json and runs npm install automatically—great for one-off cleanups, but risky in automated environments.

🛑 Maintenance Status and Future Outlook

As of 2024:

• depcheck is actively maintained, with recent releases addressing ESM and TypeScript parsing.
• knip is under active, rapid development, frequently adding support for new tooling ecosystems.
• npm-check has not seen a release since 2021 and shows signs of stagnation. While not officially deprecated, its GitHub repository has unresolved issues and lacks support for modern module systems.

⚠️ Important: npm-check should not be used in new projects due to lack of maintenance and compatibility gaps with current Node.js and npm features.

🆚 Side-by-Side Feature Comparison

💡 Practical Recommendations

• Use knip if you want a comprehensive, future-proof solution that covers dependencies, dead code, and configuration hygiene. It’s especially valuable in monorepos or complex setups.
• Use depcheck if you need a lightweight, focused tool just for unused dependencies and already have other systems for version checking.
• Avoid npm-check in new projects. Its interactive model doesn’t scale, and lack of updates makes it unreliable with modern toolchains.

In short: knip is the most capable and forward-looking; depcheck is a reliable specialist; npm-check is best left in legacy projects.