A tricky problem with npm package tests is that all devDependencies are present. If a package that is needed is only defined as devDependencies then tests will pass, but it will break when required by another package.

find_missing_dependencies.js

// It could be done more elegantly, instead of using glob it could walk the 
// relative dependencies, so it would be more flexible and could actually 
// be turned into a package that could be run before publishing to npm
var fs = require('fs')

var detective = require('detective')
var glob = require('glob')
var _ = require('lodash')
var buildinModuleNames = require('builtin-modules/static')

var paths = ['index.js'].concat(glob.sync('lib/**/*.js'))
var src = paths.map(toContent).join('\n')
var requires = detective(src)
var pkgDependencies = Object.keys(require('./package.json').dependencies)

var missingDependencies = _(requires)
  .filter(isPackage)
  .map(removePaths)
  .uniq()
  .filter(isntDependency)
  .sort()
  .value()

if (missingDependencies.length) {
  console.log('✖︎ Required dependencies missing in package.json: ' + [missingDependencies].join(', '))
  process.exit(1)
}

console.log('✔︎ All required dependencies are listed in package.json')

function toContent (path) {
  return fs.readFileSync(path, {encoding: 'utf8'})
}

function isPackage (path) {
  return path[0] !== '.' && !buildinModuleNames.includes(path)
}

function isntDependency (path) {
  return !pkgDependencies.includes(path)
}

function removePaths (path) {
  var parts = path.split(/\//)
  if (path[0] === '@') { // scoped packages
    return parts.slice(0, 2).join('/')
  }

  return parts[0]
}