[FEATURE] npm ls outputs the complete dependency tree, including subtrees under extraneous modules #576
Description
What / Why
npm ls is helpful in discovering installed modules, the usage of which can extend to many best practices regarding software packaging hygiene. One example is to detect if users install adhoc modules without going through proper tooling. This can be done by detecting extraneous annotation on npm ls output.
However, current npm ls truncates the dependencies from extraneous modules -- https://github.com/npm/cli/blob/latest/lib/ls.js#L82 introduced by npm/npm#6064. That is, we would miss the transitive dependencies from adhoc installation. This can lead to false positive on security scan, increasing unknown risks.
I would like to propose revealing all these details under a flag, say --include-extraneous-dep.
Where
npm ls
How
By feature flag
Current Behavior
npm ls truncates the dependencies from extraneous modules.
Expected Behavior
npm ls --include-extraneous-dep outputs the complete dependency tree.