**package‑hash** is a tiny Node.js utility that computes a deterministic, cryptographic hash for one or more installed npm packages based on their location, `package.json` contents, and, if the package is a Git checkout, the current HEAD, refs and uncommitted changes. It’s intended for developers (e.g., tool authors like AVA) who need a reliable cache‑salt that automatically changes when any dependency code changes.