3 ms·

The NPM CLI has 65 production dependencies from the NPM registry

• monarchwadia 5mo ago
  In an environment with so many supply chain attacks, this is scary. You can't help but be exposed to supply chain attacks with this kind of philosophy.
• benoau 5mo ago
  Looks like 122 when it's all installed
  • monarchwadia 5mo ago
    Seems it's 1078 total dependencies. Only 2 prod dependencies, but as we saw with recent attacks, dev tooling is an attack surface. I ran this script to count all packages in package-lock.json: node -e ' const lock = require("./package-lock.json"); const entries = Object.entries(lock.packages || {}).filter(([k]) => k); // skip root "" const c = { prod: 0, dev: 0, optional: 0, peer: 0, total: 0 }; for (const [, p] of entries) { c.total++; if (p.peer) c.peer++; else if (p.optional) c.optional++; else if (p.dev) c.dev++; else c.prod++; } console.log(c); ' Output: { prod: 2, dev: 955, optional: 113, peer: 8, total: 1078 } So, 1078 total dependencies.