Simply instantiating a React project with `create-react-app` generates a lock file with over 1300 transitive dependencies: $ npx create-react-app sample-ap

Simply instantiating a React project with `create-react-app` generates a lock file with over 1300 transitive dependencies: $ npx create-react-app sample-app $ cd sample-app $ cat package-lock.json | jq '.packages | length' 1393 Expecting all developers (including those new to the field) to manually audit each and every one of these packages simply isn't feasible.