I'd also like to know that.
npm handles transitive dependencies really well, but the lack of a first-class lockfile means it's difficult to tell when they update. npm shrinkwrap causes more issues than it prevents.
This is a fairly dirty script to list which npm modules are installed, sorted by when they were released. It doesn't catch everything - notably, anything installed from github instead of the public registry may or may not end up in the report.
npm i shackpank/what-the-fuck-changed && node ./node_modules/what-the-fuck-changed/index && npm prune
... will get you a report!
Output is something like:
# ^^^ way more output is up here
# Any modules it's unsure about are right at the top with a release date in the year 1000.
babel-template @ 6.8.0 2016-05-03 00:45
babel-types @ 6.8.1 2016-05-03 01:42
negotiator @ 0.6.1 2016-05-03 05:47
accepts @ 1.3.3 2016-05-03 06:05
kind-of @ 3.0.3 2016-05-03 09:09
nan @ 2.3.3 2016-05-03 23:13
babylon @ 6.8.0 2016-05-04 15:05
process-nextick-args @ 1.0.7 2016-05-04 21:37
process-nextick-args @ 1.0.7 2016-05-04 21:37
oauth-sign @ 0.8.2 2016-05-04 22:13
tunnel-agent @ 0.4.3 2016-05-04 22:14
emojis-list @ 1.0.2 2016-05-05 10:21
expand-range @ 1.8.2 2016-05-05 10:27
xss @ 0.2.13 2016-05-05 14:18
react-date-time-group @ 2.0.3 2016-05-05 15:40
which @ 1.2.8 2016-05-05 19:21
graceful-fs @ 4.1.4 2016-05-05 20:00
aws4 @ 1.4.1 2016-05-07 18:47
process @ 0.11.3 2016-05-07 20:39
process @ 0.11.3 2016-05-07 20:39
core-js @ 2.4.0 2016-05-08 02:36
core-js @ 2.4.0 2016-05-08 02:36
lodash @ 4.12.0 2016-05-08 20:25
qs @ 6.2.0 2016-05-09 00:15
@holidayextras/ui-toolkit @ 1.3.0 2016-05-09 11:03
react-prop-types @ 0.3.1 2016-05-09 19:11
content-type @ 1.0.2 2016-05-10 04:59
prepend-http @ 1.0.4 2016-05-10 06:21