Why do duplicate package versions exist in lockfiles?

When different dependencies declare non-overlapping semver constraints for the same shared package (e.g., dependency A requires semver@^6 and dependency B requires semver@^7), npm or Yarn installs multiple copies into nested node_modules folders.

How can I deduplicate package versions?

For npm, running 'npm dedupe' collapses identical version ranges where possible. For Yarn v1, use 'yarn-deduplicate yarn.lock'. Aligning version ranges in package.json also prevents duplicate installations.

Are my lockfile details uploaded to a server?

No. All dependency tree traversal occurs 100% locally in your web browser.

Lockfile Explorer & Duplicate Detector

Inspect package-lock.json and yarn.lock files to identify duplicate dependency versions, locate bloated dependencies, and streamline build sizes.

100% Client-Side Privacy

Drop package-lock.json or yarn.lock file here or click to browse

Supports npm lockfile v1, v2, v3 and yarn.lock v1

Unique Packages 0

Packages with Duplicates 0

Total Installed Instances 0

Deduplication Savings 0 instances

Package Name	Duplicate Count	Installed Versions
Drop a lockfile or click "Load Sample Lockfile" to inspect.

Frequently Asked Questions

Why are duplicate packages installed in node_modules?

npm and Yarn isolate incompatible versions by nesting them within the subfolder of the dependent package. When multiple versions cannot be hoisted together, disk usage and web bundle sizes increase.

Does this tool support Yarn and npm lockfile formats?

Yes. It automatically parses npm lockfile formats (v1, v2, and v3) as well as standard yarn.lock v1 files.

How do duplicate dependencies affect frontend bundles?

If utilities like lodash, bn.js, or core-js are duplicated, webpack/vite may bundle both versions into the client bundle, bloating user download sizes.

Is my repository lockfile kept private?

Yes. 100% of lockfile parsing and version analysis occurs client-side in your browser.