The brief
Machine written JavaScript fails in repeatable shapes: an import of a package that was never installed, a call to an API that does not exist, a dropped await, a guard that can never be false, a comment describing code that has since changed. A normal linter sees none of it, because none of it is a syntax problem. The tool had to name the shape, so a reviewer knows what to look for instead of squinting at a line number.
What it does
Fourteen families, each with its own detector and its own explanation: phantom imports, phantom APIs, crossbreeds, lost awaits, dead guards, scaffold residue, stale docs, muted catches, orphans, twins, barnacles, stale recipes, echo comments and voice.
It installs with nothing: npx tellsign runs it straight from the registry, because there is no dependency tree to resolve.
The design decision worth keeping
There is no parser. A single pass lexer produces a masked copy of every file where strings, template chunks, comments and regular expression literals are blanked out and every byte offset is preserved. Rules match against the mask, so a rule can never trip over a string that merely looks like code, and every finding still maps back to an exact position in the original file. That is what keeps precision high with a dependency count of zero.
Proof
- 33 tests, and a clean scan of its own source.
- A sweep across 20 local projects. The dominant real finding was 32 empty catch blocks, two projects accounting for most of them.
- That sweep also produced two classes of false positive: dependencies wired through configuration rather than imports, and wrapped comments being read one line at a time. Both were fixed before the release that followed.
One to remember: an early build used a NUL byte as a glob sentinel, and git committed the source file as binary. The sentinel became a compiled expression instead.