The dependency-diff action does a lot of very similar analysis:
https://github.com/e18e/action-dependency-diff
Currently, it loosely parses lock files and package.json files to do this analysis.
We should investigate what logic could be shared between the action and the CLI.