DepTax

Modern projects routinely install megabytes of third-party code to call one or two functions. That code slows builds, bloats apps and widens the supply-chain attack surface, but no everyday tool tells you which dependencies are worth their weight. DepTax is a VS Code extension that answers two questions for every dependency: how much code does it bring into the project, and how much of that code does your code actually need? It supports Node.js/TypeScript (npm, pnpm, yarn), Python (pip, Poetry, uv) and Flutter/Dart (pub). It runs entirely on your machine, with no network calls. How it works: Code used: DepTax reads your import statements and traces through the installed packages, keeping only the functions and classes your imports actually reach. Bundlers do the same when they "tree-shake" unused code. Code carried: everything the package makes available through its public entry points, including the dependencies that only it needs. What removal frees: calculated from the structure of the dependency graph, so dependencies shared with other packages are never counted twice. The ratio of used to carried code gives each package a clear status: parasitic, bloated, healthy, unused or tooling. Every verdict comes with its evidence in bytes. Results appear where developers work: a warning on the exact import line, a ranked sidebar, a full report panel and a status bar badge. Results from real projects: date-fns, used only for its format function: needed 96 KB of the 1.8 MB it brings in (5%), and removing it would free 21 MB. lodash-es, used only for debounce: 2% of its code used. quiver, used only for isBlank in a Flutter app: 2% used. Packages that really earn their place, such as React, zod and requests, come out healthy. For common cases, DepTax also has built-in native replacements. For example, its replacement for lodash's isEqual matches lodash's results on 5,000 random test inputs. This is the groundwork for replacing a wasteful package with a single command.