Anti-Pattern Sniffer

Try it

Type aps to scan, aps -i for interactive mode, or help to see all commands.

Try "aps" to scan, "aps -i" for interactive mode, or "help" for all commands.

How it works

1. Install

   npm i -D anti-pattern-sniffer

   One package. Zero dependencies. Works with Node.js 20+.

2. Scan

   npx aps

   Auto-detects your framework from package.json. Scans all source files in parallel.

3. Fix

   npx aps -i

   Browse issues in the interactive TUI. Copy fixes as AI prompts. Ignore false positives.

The sniffers

Each sniffer targets one architectural anti-pattern with regex-based heuristics. No AST parsing and no dependencies: just fast, accurate detection.

React

prop-explosion, god-hook, prop-drilling

Express

god-routes, fat-controllers, missing-error-handling, no-input-validation, callback-hell, hardcoded-secrets

NestJS

god-service, missing-dtos, business-logic-in-controllers, missing-guards, magic-strings

Before and after

Every detection comes with a concrete suggestion. Here are three sniffers catching real problems.

function UserProfileCard({
  firstName,
  lastName,
  email,
  phone,
  avatarUrl,
  role,
  department,
  isActive,
  lastLoginDate,
  onEdit,
}) {
  return (
    <div className="card">
      <img src={avatarUrl} />
      <h2>{firstName} {lastName}</h2>
      <p>{email} · {phone}</p>
      <span>{role} - {department}</span>
      <button onClick={onEdit}>Edit</button>
    </div>
  );
}

function UserProfileCard({
  user,
  org,
  isActive,
  onEdit,
}) {
  return (
    <div className="card">
      <UserAvatar user={user} />
      <UserDetails
        user={user}
        org={org}
      />
      {isActive && <ActiveBadge />}
      <button onClick={onEdit}>
        Edit
      </button>
    </div>
  );
}

const dbPassword =
  'super_secret_password_123';
const apiKey =
  'sk-live-abc123def456...';
const awsKey =
  'AKIAIOSFODNN7EXAMPLE';

const dbUrl =
  'mongodb://admin:p4ssw0rd' +
  '@db.example.com:27017/myapp';

const dbPassword =
  process.env.DB_PASSWORD;
const apiKey =
  process.env.API_KEY;
const awsKey =
  process.env.AWS_ACCESS_KEY_ID;

const dbUrl =
  process.env.DATABASE_URL;

@Injectable()
class UserService {
  constructor(
    private userRepo: UserRepository,
    private profileRepo: ProfileRepository,
    private orderRepo: OrderRepository,
    private emailService: EmailService,
    private smsService: SmsService,
    private paymentService: PaymentService,
    private cacheService: CacheService,
    private auditService: AuditService,
    private analytics: AnalyticsService,
  ) {}

  async createUser() { /* ... */ }
  async sendWelcomeEmail() { /* ... */ }
  async processPayment() { /* ... */ }
  async trackActivity() { /* ... */ }
}

@Injectable()
class UserService {
  constructor(
    private userRepo: UserRepository,
    private profileRepo: ProfileRepository,
    private cacheService: CacheService,
  ) {}

  async createUser() { /* ... */ }
  async updateProfile() { /* ... */ }
}

@Injectable()
class UserNotificationService {
  constructor(
    private emailService: EmailService,
    private smsService: SmsService,
  ) {}

  async sendWelcomeEmail() { /* ... */ }
}

More than a linter

Interactive TUI

Browse issues with keyboard navigation. Expand details, filter by framework, copy fixes as AI prompts for ChatGPT or Claude.

Plugin System

Write custom sniffers in ~20 lines. 5-stage validation for security. Register in .snifferrc.json and run alongside built-in rules.

CI/CD Ready

Exit codes for pass/fail. JSON output for parsing. Husky pre-commit hooks. GitHub Actions workflow included.

Monorepo Support

Auto-detects npm, pnpm, Nx, Turborepo, and Lerna workspaces. Per-package config inheritance. Just run aps — it figures out the rest.

Zero Dependencies

Built entirely on Node.js built-ins. No AST parsers, no transitive deps, no supply chain risk. Fast installs, small footprint.

Fully Configurable

Tune every threshold in .snifferrc.json. Disable sniffers, change severity levels, set per-framework rules. Setup wizard included.

Common questions

How is this different from ESLint?

ESLint checks code style and syntax. APS checks architecture — are your components too big? Are your services doing too much? Are your route handlers too fat? These are structural problems that ESLint doesn't target.

Why regex instead of AST parsing?

Zero dependencies. Regex-based heuristics are fast, portable, and good enough for architectural pattern detection. APS isn't checking syntax — it's checking structure.

Does it work with TypeScript?

Yes. APS scans .ts, .tsx, .js, and .jsx files. Since it uses regex heuristics rather than a parser, TypeScript syntax is handled naturally.

Can I write my own sniffers?

Yes. The plugin system lets you write custom sniffers in ~20 lines of JavaScript. They go through 5-stage validation for security and run alongside built-in rules.

Will it slow down my CI?

No. APS scans files in parallel and uses only regex matching — no AST parsing overhead. A typical project scans in under 2 seconds.

What’s new