You could only ship the source code and package-lock file and run `npm ci` or `npm install --production`, which would only install dependencies you're actually using on your production machine, rather than including testing libraries or build frameworks.
Even better, you could set up a build and take advantage of tree-shaking (to some extent at least), then ship less code in fewer files.