Helper script for lazy codebases that don't freeze package versions.

verifyPackageVersion.js

#!/usr/bin/node
const root = process.cwd()
const lockVersions = Object.fromEntries(Object.entries(require(`${root}/package-lock.json`).dependencies).map(([pkg, { version }]) => ([pkg, version])))
const { dependencies, devDependencies } = require(`${root}/package.json`)
const installedDependencies = Object.fromEntries(Object.entries(dependencies || {}).map(([pkg, looseVersion]) => {
  return [pkg, { version: looseVersion, installed: lockVersions[pkg] }]
}).filter(([_, { version, installed }]) => {
  version = version.startsWith('^') ? version.split('^')[1] : version
  return version !== installed
}))
const installedDevDependencies = Object.fromEntries(Object.entries(devDependencies || {}).map(([pkg, looseVersion]) => {
  return [pkg, { version: looseVersion, installed: lockVersions[pkg] }]
}).filter(([_, { version, installed }]) => {
  version = version.startsWith('^') ? version.split('^')[1] : version
  return version !== installed
}))
console.log(JSON.stringify({
  installedDependencies,
  installedDevDependencies
}, null, 1))