5 ms·

NPM packages with most dependencies

36 points by supermdguy 9y ago

tw1010 9y ago
Are we going to go around dependency-shaming packages now?
- andreyf 9y ago
  Where is the shame coming from?
  - nwsm 9y ago
    Probably this article: https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://hackernoon.com/im-harvesting-credit-card-numbers-and...
- andrewmcwatters 9y ago
  If you, at first thought, believed this to be about shame, it says something about the JavaScript ecosystem.
  - SquareWheel 9y ago
    For what other reason would it be posted?
  - tw1010 9y ago
    That's what I thought most people would think this would be about, based on the news cycle around this stuff (like leftpad). It's more a reflection on what the collective unconscious thinks about it, than an objective measure of the health of the ecosystem.
lev99 9y ago
Having smaller packages each with many dependencies is a common node design pattern. I think this started because it doesn't have a lot of framework code to relay on, so simpler functions became packages. It has advantages and disadvantages. People concerned about production uptime/deployment should keep copies of all dependencies on their network, and run npm against their network repo.
andreyf 9y ago
There are immediate dependencies? Seems "depended on" should include sub-deps, as well.
drinchev 9y ago
No idea why this list is on the first page of HN, but it looks like ( at least the 10 that I clicked around ) are very spammy, not at all popular, packages that I doubt have any use. Probably the attention to this article is the good old debate about npm and the huge dependencies that a package can have. Which is not always a bad thing. Actually I wrote an article [1] about it. 1 : http://www.drinchev.com/blog/increase-your-dependencies/ http://www.drinchev.com/blog/increase-your-dependencies/
schneidmaster 9y ago
I don't think there's much meaningful information to glean from this list. The package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author, it doesn't have any serious purpose. Many of the other high-ranking packages simply have put their devDependencies in their dependencies, resulting in a bunch of babel plugins and the like (a mistake to be sure, but not indicative of anything in particular about the state of npm package usage).
- Yokohiii 9y ago
  It is not a mistake, it is an error.
  - jeremejevs 9y ago
    It is neither, devDependencies is a redundant distinction for projects where a module bundler is involved, like Webpack, since there's no scenario where you wouldn't want to pull these dependencies.
    - minitech 9y ago
      These are packages published to npm. If you’re bundling all of your dependencies into your package with webpack before publishing it, they should all go in devDependencies, since someone installing the published package doesn’t need them.
      - jeremejevs 9y ago
        You are correct. Got too used to the "just add everything to regular dependencies" shortcut in private projects, which doesn't cut it for published modules.
- Scarbutt 9y ago
  he package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author In case you don't know, lots of those packages are one liners. ex: https://github.com/sindresorhus/array-uniq/blob/master/index.js https://github.com/sindresorhus/array-uniq/blob/master/index...
partycoder 9y ago
What I've learned from this is that npm itself has a lot of dependencies, and that is bad. It means any of those 500+ packages can take over npm itself for malicious purposes. Other than that, there's not much to see. I would like this list being filtered by usage (e.g: installs/downloads). Some packages seem to be there for personal use.
alsadi 9y ago
Hall of fame and hall of shame. Don't force it. Use larger hammer. Don't panic just throw more dependencies
- alsadi 9y ago
  http://turnoff.us/geek/my-adorable-useless-code/ http://turnoff.us/geek/my-adorable-useless-code/
imtringued 9y ago
The top 50 all had less than 100 downloads this month. Not very interesting.

36 points by supermdguy 9y ago

tw1010 9y ago

Are we going to go around dependency-shaming packages now?

andreyf 9y ago
Where is the shame coming from?
- nwsm 9y ago
  Probably this article: https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5 https://hackernoon.com/im-harvesting-credit-card-numbers-and...
andrewmcwatters 9y ago
If you, at first thought, believed this to be about shame, it says something about the JavaScript ecosystem.
- SquareWheel 9y ago
  For what other reason would it be posted?
- tw1010 9y ago
  That's what I thought most people would think this would be about, based on the news cycle around this stuff (like leftpad). It's more a reflection on what the collective unconscious thinks about it, than an objective measure of the health of the ecosystem.

lev99 9y ago

Having smaller packages each with many dependencies is a common node design pattern. I think this started because it doesn't have a lot of framework code to relay on, so simpler functions became packages. It has advantages and disadvantages. People concerned about production uptime/deployment should keep copies of all dependencies on their network, and run npm against their network repo.

andreyf 9y ago

There are immediate dependencies? Seems "depended on" should include sub-deps, as well.

drinchev 9y ago

No idea why this list is on the first page of HN, but it looks like ( at least the 10 that I clicked around ) are very spammy, not at all popular, packages that I doubt have any use. Probably the attention to this article is the good old debate about npm and the huge dependencies that a package can have. Which is not always a bad thing. Actually I wrote an article [1] about it. 1 : http://www.drinchev.com/blog/increase-your-dependencies/ http://www.drinchev.com/blog/increase-your-dependencies/

schneidmaster 9y ago

I don't think there's much meaningful information to glean from this list. The package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author, it doesn't have any serious purpose. Many of the other high-ranking packages simply have put their devDependencies in their dependencies, resulting in a bunch of babel plugins and the like (a mistake to be sure, but not indicative of anything in particular about the state of npm package usage).

Yokohiii 9y ago
It is not a mistake, it is an error.
- jeremejevs 9y ago
  It is neither, devDependencies is a redundant distinction for projects where a module bundler is involved, like Webpack, since there's no scenario where you wouldn't want to pull these dependencies.
  - minitech 9y ago
    These are packages published to npm. If you’re bundling all of your dependencies into your package with webpack before publishing it, they should all go in devDependencies, since someone installing the published package doesn’t need them.
    - jeremejevs 9y ago
      You are correct. Got too used to the "just add everything to regular dependencies" shortcut in private projects, which doesn't cut it for published modules.
Scarbutt 9y ago
he package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author In case you don't know, lots of those packages are one liners. ex: https://github.com/sindresorhus/array-uniq/blob/master/index.js https://github.com/sindresorhus/array-uniq/blob/master/index...

partycoder 9y ago

What I've learned from this is that npm itself has a lot of dependencies, and that is bad. It means any of those 500+ packages can take over npm itself for malicious purposes. Other than that, there's not much to see. I would like this list being filtered by usage (e.g: installs/downloads). Some packages seem to be there for personal use.

alsadi 9y ago

Hall of fame and hall of shame. Don't force it. Use larger hammer. Don't panic just throw more dependencies

alsadi 9y ago
http://turnoff.us/geek/my-adorable-useless-code/ http://turnoff.us/geek/my-adorable-useless-code/

imtringued 9y ago

The top 50 all had less than 100 downloads this month. Not very interesting.