vite-plugin-generate-package-json

Vite plugin that generates a package.json and package-lock.json containing only the packages your Vite bundle actually imports. Useful for creating accurate SBOMs and avoiding false positives in NPM audit/SCA scans caused by misclassified devDependencies. v1.4.0 supports Vite 4–8. Actively maintained with regular updates, written in TypeScript with bundled type definitions. Differentiator: Unlike generic SBOM tools, it only includes runtime dependencies actually bundled, reducing noise in security reports.