npm ls Dependency Tree (JSON)
The nested tree `npm ls --json` prints, where a shared dependency is REPEATED under every parent rather than deduplicated — so counting objects gives a larger number than the graph has nodes. Every package, version, hash and licence is fictional — the tree describes nothing real.
{
"name": "orchard-gateway",
"version": "4.2.0",
"dependencies": {
"@orchard-example/router": {
"version": "2.1.3",
"resolved": "https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz",
"overridden": false,
"dependencies": {
"example-logger": {
"version": "3.4.1",
"resolved": "https://registry.orchard.example/example-logger/-/example-logger-3.4.1.tgz",
"overridden": false
},
"example-retry": {
"version": "1.0.4",
"resolved": "https://registry.orchard.example/example-retry/-/example-retry-1.0.4.tgz",
"overridden": false
}
}
},
"@orchard-example/http-core": {
"version": "1.8.0",
"resolved": "https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz",
"overridden": false,
"dependencies": {
"example-logger": {
"version": "3.4.1",
"resolved": "https://registry.orchard.example/example-logger/-/example-logger-3.4.1.tgz",
"overridden": false
},
"example-json-path": {
"version": "2.0.5",
"resolved": "https://registry.orchard.example/example-json-path/-/example-json-path-2.0.5.tgz",
"overridden": false
}
}
},
"example-metrics": {
"version": "4.0.0",
"resolved": "https://registry.orchard.example/example-metrics/-/example-metrics-4.0.0.tgz",
"overridden": false,
"dependencies": {
"example-logger": {
"version": "3.4.1",
"resolved": "https://registry.orchard.example/example-logger/-/example-logger-3.4.1.tgz",
"overridden": false
}
}
},Specifications
- Seed
- 51200
- Sample Only
- true
- Tool
- npm ls --json (shape)
- Root Dependencies
- 5
- Structure
- nested, repeats shared nodes
- Max Depth
- 2
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Convert a nested install tree into a deduplicated dependency graph.
- Expected result
- The tree contains example-logger three times but the resulting graph has one node for it, matching the 10-node JSON graph fixture.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“npm ls Dependency Tree (JSON)” is a deterministic Novus Examples fixture for JSON parsing, Graph data, Conversion testing. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · LF · nested, repeats shared nodes. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("npm-ls-tree.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonDependency Graph With Diamond Dependencies (JSON)An explicit node/edge dependency graph with in-degree, out-degree and depth precomputed, plus a diamonds array naming the two shared nodes and their parents — the reference answer for any graph builder run against the SBOMs and lockfiles here. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCycloneDX SBOM With Diamond Dependency GraphA CycloneDX 1.6 SBOM whose dependencies array contains two diamonds: the fictional example-logger is reached through three parents and example-json-path through two, both resolving to a single node. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonSPDX 3.0 Application SBOM (JSON-LD)An SPDX 3.0 SBOM in JSON-LD — the element-graph model that replaced the 2.x document layout — describing the same fictional tree with software_Package elements and typed Relationship nodes. Every package, version, hash and licence is fictional — the tree describes nothing real.
- graphmlDependency Graph (GraphML)The dependency graph in GraphML, with typed attribute keys for node version, licence and depth and for edge range — the interchange format graph databases and analysis tools import. Every package, version, hash and licence is fictional — the tree describes nothing real.
- mmdDependency Graph (Mermaid Flowchart)The dependency graph as Mermaid, for embedding in Markdown documentation — labelled edges carry the declared range and a classDef highlights the two diamond joins. Every package, version, hash and licence is fictional — the tree describes nothing real.
- dotDependency Graph With a Cycle (Graphviz DOT)The cyclic plugin graph as DOT, with the three cycle edges highlighted. Graphviz renders it happily, which is exactly why a topological sort must be the thing that rejects it. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.