npm installing hundreds of packages - npm

Question

npm now installs a package-lock.json every time which seems to be a part of npm now. However, this simple package.json file when run with npm install installs over 300 packages. what could be going wrong and why are there 300+? even without the package-lock file when run (it then creates the lock file) and still gives 300+ packages
{
"name": "Package",
"version": "0.0.1",
"dependencies": {},
"devDependencies": {
"grunt": "^1.0.2",
"grunt-contrib-clean": "^1.1.0",
"grunt-contrib-compress": "^1.4.3",
"grunt-contrib-concat": "^1.0.1",
"grunt-contrib-connect": "^1.0.2",
"grunt-contrib-copy": "^1.0.0",
"grunt-contrib-cssmin": "^2.2.1",
"grunt-contrib-uglify": "^3.3.0",
"grunt-contrib-watch": "^1.1.0",
"grunt-sass": "^2.1.0",
"grunt-usemin": "^3.1.1"
}
}

Answer 1

Those packages depend on other packages, which depend on other packages, which depend on yet other packages…. A package manager resolves that entire dependency graph, which can easily grow into the hundreds from an innocent-looking initial list.
The package-lock.json file you mention can help you understand how this happens for your particular dependencies. Look for "requires". For example, in your setup, grunt-sass requires node-sass:
"grunt-sass": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/grunt-sass/-/grunt-sass-2.1.0.tgz",
"integrity": "sha512-XkexnQt/9rhReNd+Y7T0n/2g5FqYOQKfi2iSlpwDqvgs7EgEaGTxNhnWzHnbW5oNRvzL9AHopBG3AgRxL0d+DA==",
"dev": true,
"requires": {
"each-async": "1.1.1",
"node-sass": "4.9.0",
"object-assign": "4.1.1"
}
},
…which has 19 separate dependencies:
"node-sass": {
"version": "4.9.0",
...
"requires": {
"async-foreach": "0.1.3",
"chalk": "1.1.3",
"cross-spawn": "3.0.1",
"gaze": "1.1.3",
"get-stdin": "4.0.1",
"glob": "7.0.6",
"in-publish": "2.0.0",
"lodash.assign": "4.2.0",
"lodash.clonedeep": "4.5.0",
"lodash.mergewith": "4.6.1",
"meow": "3.7.0",
"mkdirp": "0.5.1",
"nan": "2.10.0",
"node-gyp": "3.6.2",
"npmlog": "4.1.2",
"request": "2.79.0",
"sass-graph": "2.2.4",
"stdout-stream": "1.4.0",
"true-case-path": "1.0.2"
},
...
}
…and just one of those, request, itself introduces another 20:
"request": {
"version": "2.87.0",
...
"requires": {
"aws-sign2": "0.7.0",
"aws4": "1.7.0",
"caseless": "0.12.0",
"combined-stream": "1.0.6",
"extend": "3.0.1",
"forever-agent": "0.6.1",
"form-data": "2.3.2",
"har-validator": "5.0.3",
"http-signature": "1.2.0",
"is-typedarray": "1.0.0",
"isstream": "0.1.2",
"json-stringify-safe": "5.0.1",
"mime-types": "2.1.18",
"oauth-sign": "0.8.2",
"performance-now": "2.1.0",
"qs": "6.5.2",
"safe-buffer": "5.1.2",
"tough-cookie": "2.3.4",
"tunnel-agent": "0.6.0",
"uuid": "3.2.1"
}
},
You can see how it gets to 300 so quickly.