Just say no.
If you don't actually want to test the software, and just want to create a production mobile/desktop application, then it depends on codova, cordova-icon, cordova-splash, semver and it's own source code. That's not a long list. If you want to test it, then it's probably not a shock that it pulls in testing frameworks for testing javascript UIs.
including something from an apparently-non-standard source
Here are the listed requirements from above:
npm install -g cordova
npm install -g grunt-cli
npm install -g cordova-icon and npm install cordova-splash
Can you point out which of these is 'apparently-non-standard'?
It's not the list of top-level pieces of software, it's the amount of code that could have contact with the plaintext or the encryption keys.
> If you don't actually want to test
And build! Don't forget the building itself. It's not so much harder to exploit an app even if all you have access to is its build stage.
----
This is security software we are talking about. The more lines of code that touch it, the more risky it is of being vulnerable. Not to mention the sheer astronomical difficulty of auditing it. From what I know of the industry, I wouldn't be surprised if a security auditor plain refused to touch this because of the sheer magnitude.
And that's without even mentioning it uses npm.
https://www.passwordstore.org/
For syncing, either use git, or something like syncthing. It doesn't really matter, because all synced files are encrypted by GnuPG before any syncing tools gets access to it.
npm doesn't provide even that much guarantee.
I don't doubt that some people will be more effective at using Cordova. The problem is people treat this decision as if it is independent of the people who will build the solution. Somebody with years of training doing JavaScript and practically no experience with writing native code will likely be much faster with Cordova. That is why these projects exist in the first place. There are so many JavaScript developers out there. For them even a crappy setup like Cordova will still be faster than native development.
But in reverse if you actually got good experience with native platforms and know the tools, Cordova is not going to deliver. You wont have access to the kind of debugging tools, editors, type checking, GUI builders, documentation etc you get on a native platform, which makes a native developer work efficiently.
For a security software? It may not be too bloated for a web app, but for a piece of security software it is absolutely bloated.
Note: I'm not talking from a utility point-of-view, that "C'mon, writing a security-related app doesn't have to use so much stuff".
I'm talking from a safety point-of-view, that "Security stuff should absolutely not have such a large code footprint".