No unused dependencies in package.json

Unused production dependencies add bundle weight, extend install time, and expand your attack surface — every extra package is a potential supply chain compromise vector. CWE-1357 (Reliance on Insufficiently Trustworthy Component) applies: dependencies you didn't intend to ship still ship. AI-generated codebases accumulate unused packages frequently: the model installs axios and moment in one session, then the next session uses native fetch and inline date formatting without removing the earlier additions.

Run a dependency check to find unused packages:

npx depcheck

Verify each reported unused package before removing — some packages are loaded via config rather than imports (ESLint plugins, Babel presets). For confirmed unused packages:

npm uninstall axios moment lodash

Also audit whether production dependencies have been misplaced as devDependencies or vice versa. For deeper supply chain analysis, the Dependency & Supply Chain Audit covers version pinning, lockfile integrity, and provenance checks.