NPM packages with most dependencies | Hacker News Reader

NPM packages with most dependencies

gist.github.com

36 pointssupermdguy22 comments

No idea why this list is on the first page of HN, but it looks like ( at least the 10 that I clicked around ) are very spammy, not at all popular, packages that I doubt have any use.

Probably the attention to this article is the good old debate about npm and the huge dependencies that a package can have. Which is not always a bad thing. Actually I wrote an article [1] about it.

1 : http://www.drinchev.com/blog/increase-your-dependencies/

I don't think there's much meaningful information to glean from this list. The package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author, it doesn't have any serious purpose. Many of the other high-ranking packages simply have put their devDependencies in their dependencies, resulting in a bunch of babel plugins and the like (a mistake to be sure, but not indicative of anything in particular about the state of npm package usage).

It is not a mistake, it is an error.

It is neither, devDependencies is a redundant distinction for projects where a module bundler is involved, like Webpack, since there's no scenario where you wouldn't want to pull these dependencies.

These are packages published to npm. If you’re bundling all of your dependencies into your package with webpack before publishing it, they should all go in devDependencies, since someone installing the published package doesn’t need them.

You are correct. Got too used to the "just add everything to regular dependencies" shortcut in private projects, which doesn't cut it for published modules.

he package at the top is literally just a package.json that installs all the packages published by one particularly prolific npm author

In case you don't know, lots of those packages are one liners.

ex: https://github.com/sindresorhus/array-uniq/blob/master/index...

There’s history behind those one-liners: https://github.com/sindresorhus/array-uniq/commit/fb96562015...

That package has no dependencies. The problem is when these one liner packages packages have dependencies and then in turn those dependencies have even more dependencies.

Multiple packages on this list are like that first one. big-bertha is literally just the top 500 dependencies on npm:

> This package represents the top 500 dependencies on npm according to https://www.npmjs.com/browse/depended.

Are we going to go around dependency-shaming packages now?

Where is the shame coming from?

Probably this article:

https://hackernoon.com/im-harvesting-credit-card-numbers-and...

If you, at first thought, believed this to be about shame, it says something about the JavaScript ecosystem.

For what other reason would it be posted?

That's what I thought most people would think this would be about, based on the news cycle around this stuff (like leftpad). It's more a reflection on what the collective unconscious thinks about it, than an objective measure of the health of the ecosystem.

Having smaller packages each with many dependencies is a common node design pattern. I think this started because it doesn't have a lot of framework code to relay on, so simpler functions became packages.

It has advantages and disadvantages. People concerned about production uptime/deployment should keep copies of all dependencies on their network, and run npm against their network repo.

What I've learned from this is that npm itself has a lot of dependencies, and that is bad. It means any of those 500+ packages can take over npm itself for malicious purposes.

Other than that, there's not much to see. I would like this list being filtered by usage (e.g: installs/downloads). Some packages seem to be there for personal use.

There are immediate dependencies? Seems "depended on" should include sub-deps, as well.

The top 50 all had less than 100 downloads this month. Not very interesting.

Hall of fame and hall of shame.

Don't force it. Use larger hammer.

Don't panic just throw more dependencies

http://turnoff.us/geek/my-adorable-useless-code/

Reply on news.ycombinator.com