3 ms·
Ask HN: How many NPM package dependencies your projects use?
I have a smallish express/react project. Recently I audited the package.json to remove unused packages and I discovered that project depends(and sub-depends) on 1101 packages. One of them is basic-ftp and I had no clue about it. npm why tells me that pubnub depends on it. I will be digging further why notifications need to be delivered over ftp.
Run the following command at root of your project to find out how many packages do u have.
npm list -ap | sort | uniq
- nullindividual 2y agoThat's beyond ridiculous, as an ecosystem. There is zero means for a user of npm to audit packages end-to-end. Is anyone attempting to improve upon this poisoned web of packages?
- ssahoo 2y agoIt's only getting worse overtime. I have been advising devs to do more at code reviews. Every time a new package gets added or upgraded, that needs dual sign-off to justify it's use.