Mmmm, so... sub 100MB for a bundler + compiler + etc?

  - Xcode, for iOS/Mac Development, is usually around 5GB (and 
  no, even if you remove every single simulator, it's still over 100-200MB).

  - Android Studio is roughly the same deal as Xcode.  

  - I've not used Windows so I can't say for sure, but I'd be surprised if the various tech there doesn't follow this pattern.

77MB is nothing, and if you care about this, you're caring about the wrong things.

689 packages is enormous surface area for a leftpad-like (or worse) failure. Given that nobody is auditing those packages and many of the people who maintain them aren't adhering to best security practices[1], I don't think taking nearly 700 dependencies that you are going to treat like a black box is a safe or responsible choice.

Xcode and the Android SDK each come from a single vendor who provides an integrated development stack and presumably vets the contents. Does anybody do that with these npm packages?

It seems like every time I run the du command in my node_modules folder, I find some crap that shouldn't be there. Earlier this year, I submitted a PR that reduced the size of the babel react preset install footprint by about a third, just by removing a totally unused dependency that nobody noticed. I don't think the contents of npm packages get nearly enough scrutiny and it scares the hell out of me.

[1] https://www.bleepingcomputer.com/news/security/52-percent-of...

How are you using du to find things that shouldn't be in node_modules? Wouldn't you need to build up a dependency tree, based on your app's package.json and recursing into every module's peer dependencies?

Would you mind linking to your PR? Would love to take a look.

It literally just removes a line from the package.json file of one of the sub-dependencies: https://github.com/babel/babel/pull/5484

It's crazy to me that a package that is downloaded from npm over 4 million times a month gets so little scrutiny that nobody but me noticed a 5MB dependency on all of lodash that wasn't even being used.

Build tool. Not app code. How is security relevant here?

And you don't care if a malicious party compromises the development machine on which it runs? I can think of a whole lot of really damaging things that somebody could do running arbitrary JavaScript code with user-level privileges on thousands of developer workstations.

With various CI setups and some server-side rendering configurations, there are potentially scenarios where build tooling actually do run in environments where there are higher risks, though it's not as applicable in this specific case.

Not really about security, but I've seen some deps that even track their usage (aggressively). So, I totally agree with the "not having the same scrutiny" as other tooling methods.

Exactly

One of the things I like about OSS and things like Stack Overflow is that in the old days, if I solved a hard problem, I solved it for a couple dozen people I worked with and maybe some folks at my next job. In some cases it made it hard to justify the work because I saved everybody 10 minutes a month and spent a week working on it. Which may be bad math for another reason: if I saved you the most aggravating ten minutes of your month, it may be worth many multiples of that ten minutes to you.

If I put the answer on the internet, then thousands of people benefit. If my work only save you five minutes one time, it still may be worth the bother in the grand scheme of things.

Which is a long way around to my point: this group is curating a bunch of build related modules which means I don't have to pay as much attention. That's not automatically a win (especially if they do a poor job of keeping up, which happens a lot in this space), but it has potential at least to be pretty useful.

See it as a silly but efficient cache.

Well, npm may implement some kind of content-addressable storage to transparently deduplicate the dependencies tree on disk. It's not quite easy to do well.

As long as your bundle size is small, and the build times are fast, it's a clear improvement, at the expense of spending like 0.15% of even the cheapest 60GB SSD.

Sure, its shifting complexity around, but its hard to argue that the API for this is more complex than the bloated boilerplate you're talking about. For some people the simplified API is worth the 77 extra MB.

I don't know about you, but that's where and what by i want tedious, error-prone work handled - out of my way and by the computer.

If you have some simpler, better alternative to html, css, and JavaScript for websites, more power to you. Over here in the real world, though, we've got stuff to do.

What kind of argument is this? This won't be part of your bundle — it won't increase the size of your prod build but can save your precious time.