Hey. I work at Sky and it has recently come to my attention that one our projects (which is using eslint-plugin-sonarjs) is pulling in a large amount of dependencies. You can see the ridiculousness of it all here:
I’m attaching this image just to document the result at this point in time (2025-08-11):
I’ve also become acquainted with the story of these dependencies. There’s an individual who goes around gaining access to open source JavaScript projects, “adding support for node 0.4”. He does this by adding dependencies that he controls and that depend on other dependencies of his. So he creates this web of dependencies that all get downloaded by popular open source projects such as eslint-plugin-sonarjs. Also, he’s part of a program that pays per NPM downloads. So it appears there’s a financial motivation for all this.
The crazy thing is that this isn’t recent, it’s been happening for a few years now.
If you want to go down the rabbit hole:
-
https://github.com/A11yance/axobject-query/pull/354#issuecomment-2184109808
-
https://github.com/SukkaW/nolyfill/issues/67#issuecomment-2189727471
From my understanding there is a now a community of people trying to solve this ecosystem issue. There is now a much smaller dependency called jsx-ast-utils-x that acts as a drop-in replacement (example of one PR doing this change).
Would you be open to doing the same?