Every major package manager can print its full dependency tree, including transitive packages. Use npm ls with the all option, the Maven dependency plugin's tree goal, cargo tree, go list with the all pattern, or dotnet list package with the transitive option. Run the one for your stack, then feed the result to a scanner.
Definitions
Transitive dependency. A package you did not declare that arrives because a dependency needs it.
Dependency tree. The nested view of what depends on what.
Depth. How many levels from your project a package sits.
Commands by ecosystem
| Ecosystem | Command | What to know |
|---|---|---|
| npm | npm ls --all | Default depth is 1. The all option shows every level |
| Maven | mvn dependency:tree | Verbose mode shows nodes removed by conflict resolution |
| Cargo | cargo tree | Packages marked with an asterisk were shown earlier |
| Go | go list -m all | Prints the selected module versions for the build |
| .NET | dotnet list package --include-transitive | Transitive is not the default |
npm ls --all
mvn dependency:tree -Dverbose=true
cargo tree
go list -m all
dotnet list package --include-transitive
Notes on each
The npm docs say the tree is the logical dependency graph, not the physical layout of node_modules. A package lock option lists the tree from the lockfile instead of the installed folder.
Maven's tree goal can write to a file and, in newer plugin versions, emit JSON, DOT, GraphML or TGF.
Cargo reflects a feature unified graph, which is close to what a build compiles but not an exact guarantee.
In Go, the build list is what minimal version selection chooses. With module graph pruning, some modules appear in the list but cannot be imported until you add them explicitly.
Steps
- Run the command for your ecosystem and save the output.
- Count how many packages are direct and how many are transitive.
- Run your vulnerability scan against the same project.
- For each transitive finding, trace the path to a direct parent. A companion post covers that step.
Why bother
The OWASP Top 10 entry on vulnerable and outdated components lists, among the signs you are at risk, not knowing the versions of all components, nested dependencies included. A tree listing is the quickest way to answer that for one project.
Try it yourself
Click through it at your own pace, or open it full screen.
Expand a direct dependency to see how many transitive packages sit beneath it.
Quick check
Why is my tree different from my teammate's?
Usually a missing or stale lockfile. Without one, each machine resolves versions on its own.
Do dev dependencies appear in the tree?
Yes, unless you omit them. Most tools let you filter by dependency type.
Safeguard builds this inventory automatically as part of SBOM and dependency scanning. A free scan shows the tree for a repository.
Sources
- npm docs, npm ls
- Apache Maven Dependency Plugin, dependency:tree
- Cargo book, cargo tree
- Go Modules Reference
- Microsoft Learn, Auditing package dependencies
Last reviewed: 19 October 2026.
