Almost all of those requirements are only for developing / testing the repository. That's not uncommon for most languages / projects.

The language it's written in, the testing framework, and the support library that lets it target more platforms? That doesn't seem too bloated to me.

> That doesn't seem too bloated to me.

For a security software? It may not be too bloated for a web app, but for a piece of security software it is absolutely bloated.

Note: I'm not talking from a utility point-of-view, that "C'mon, writing a security-related app doesn't have to use so much stuff".

I'm talking from a safety point-of-view, that "Security stuff should absolutely not have such a large code footprint".

But... it really isn't. This is kind of the norm for node projects + cordova stuff.