4Developers Katowice 2019: Honey, I shrunk the node_modules!, Adam Polak

## Overview Adam Polak presents practical strategies for reducing the size of Node.js node_modules directories, a persistent problem in JavaScript development. The talk addresses the "bloated node_modules" issue by explaining how npm dependency management works and providing actionable techniques to identify and eliminate unnecessary packages and code.

## How npm Dependency Management Creates the Problem Polak explains three core principles of npm package installation. First, when a package is installed, not only the requested package but all of its dependencies are downloaded and placed in node_modules with their own nested dependencies. Second, if a package version already exists in node_modules and matches the requirements, it is reused rather than duplicated. Third, when version requirements cannot be satisfied by existing packages, npm creates local duplicate copies within a package's own node_modules directory. This third principle—deduplication failure leading to duplicate installations—is a major driver of bloat. Polak illustrates this with a real project example: updating from Babel 6.x to 7.x caused node_modules to grow from 200MB to 600MB because twelve dependencies required Babel 6.x, forcing npm to maintain both versions locally.

## Identifying the Problem Polak emphasizes that awareness is the first step. Most developers unknowingly install dozens or hundreds of packages when adding a single library. He criticizes the common practice of copying Stack Overflow solutions that recommend "just use this library" without considering what dependencies come along. He provides the example of installing a small request-making library that brought 46 undocumented dependencies. Using the command `du -sh *` with sorting and filtering, developers can identify which packages consume the most space. Polak demonstrates finding packages over 1GB in real projects and recommends tools like Bundlephobia to analyze package sizes and dependencies before installation.

## Optimization Techniques Polak details several practical approaches:

1. **Dependency Reduction**: Replace large packages with smaller alternatives when possible. He compares testing frameworks: Mocha (115 dependencies, 12MB) versus lighter options, noting that developers often use only 5-10% of a large package's functionality.

2. **Package Cleanup Tools**: Tools like pruning utilities can remove unnecessary files such as tests, documentation, and alternative build formats. However, Polak notes these are sometimes unreliable—testing showed only 4 out of 10 projects worked correctly after automated pruning.

3. **Production vs. Development Separation**: Using `npm install --production` removes dev dependencies, reducing the example project from 196MB to 144MB (52MB savings).

4. **Custom Cleanup Scripts**: For deeply nested optimizations, developers can create custom scripts to remove specific unnecessary files and configurations from packages before deployment.

5. **Selective Inclusion**: Rather than installing a large package for minimal functionality, copying small code snippets directly (with proper license attribution) can be more efficient.

## Real-World Results Polak walks through a real project optimization: - **Starting point**: 297MB (development dependencies) - **Production build**: 196MB - **After pruning**: 144MB - **After custom cleanup**: 106MB

This represents a 53% reduction from the initial size. He notes that the same techniques applied to development builds yield a demo version of 167MB—sometimes lighter than the full production build due to different dependency patterns.

## Security and Control Benefits Beyond size reduction, Polak argues that understanding and controlling dependencies improves security. Fewer dependencies mean fewer opportunities for malicious code injection. He references a real incident where a package maintainer modified a library after transferring ownership, highlighting why awareness of what is being installed matters. Reducing bloat also improves: - Build times - Application startup performance - Memory usage - System load for users

## Takeaways Polak's core message is about conscious dependency management rather than blindly adding packages. Developers should ask whether large packages are truly necessary or if smaller alternatives exist. Understanding node_modules structure, using analysis tools, and regularly auditing dependencies are essential practices. The talk emphasizes that while reusing libraries is valuable, awareness of what is being installed—and why—is equally important for building lighter, faster, and more secure applications.