# No unused dependencies in package.json

- **Pattern:** `ab-000676` (`code-maintainability.dependency-management.no-unused-deps`)
- **Severity:** medium
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000676
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000676)

## Why it matters

Unused production dependencies add bundle weight, extend install time, and expand your attack surface — every extra package is a potential supply chain compromise vector. CWE-1357 (Reliance on Insufficiently Trustworthy Component) applies: dependencies you didn't intend to ship still ship. AI-generated codebases accumulate unused packages frequently: the model installs `axios` and `moment` in one session, then the next session uses native `fetch` and inline date formatting without removing the earlier additions.

## Severity rationale

Medium because unused dependencies bloat the bundle and attack surface without delivering functionality, but they do not immediately break application behavior.

## Remediation

Run a dependency check to find unused packages:

```bash
npx depcheck
```

Verify each reported unused package before removing — some packages are loaded via config rather than imports (ESLint plugins, Babel presets). For confirmed unused packages:

```bash
npm uninstall axios moment lodash
```

Also audit whether production dependencies have been misplaced as `devDependencies` or vice versa. For deeper supply chain analysis, the Dependency & Supply Chain Audit covers version pinning, lockfile integrity, and provenance checks.

## Detection

- **ID:** `no-unused-deps`
- **Severity:** `medium`
- **What to look for:** Compare the packages listed in `package.json` `dependencies` and `devDependencies` against actual usage in source files. Look for packages that:
  - Appear in `dependencies` but are never imported in any source file
  - Were added during AI-assisted development but whose functionality ended up unused
  - Duplicate functionality of another installed package

  Focus especially on `dependencies` (production) vs. `devDependencies` (development-only) — packages used only in tests or build scripts should be in `devDependencies`, not `dependencies`. Tools like `depcheck` can automate this analysis; check if it's in the project's scripts.
- **Pass criteria:** Count every package in `dependencies` and check each for at least one import in source code. No more than 2 packages in `dependencies` appear to be unused (not imported anywhere in source code). Report the count even on pass: "X of Y production dependencies are actively imported."
- **Fail criteria:** 3 or more packages in `dependencies` are never imported in source code, OR multiple packages in `devDependencies` appear to be production dependencies misplaced there (or vice versa).
- **Skip (N/A) when:** The project has fewer than 5 total dependencies. Signal: `dependencies` + `devDependencies` combined has fewer than 5 entries.
- **Detail on fail:** `"3 unused packages found in dependencies: 'axios' (never imported — project uses native fetch), 'moment' (never imported — date formatting done inline), 'lodash' (never imported). These add ~150KB to the bundle unnecessarily."` or `"5 packages in dependencies should be in devDependencies: jest, @types/jest, ts-jest, @testing-library/react, @testing-library/jest-dom."`
- **Remediation:** Unused dependencies bloat your install time, bundle size, and attack surface. Run a dependency check:

  ```bash
  npx depcheck
  ```

  For each unused package reported, verify it's truly unused (some packages are loaded via config, not imports — e.g., ESLint plugins) before removing. To remove:
  ```bash
  npm uninstall axios moment lodash
  ```

  For a deeper analysis of dependency risks and supply chain health, the Dependency & Supply Chain Audit covers this in detail.

## External references

- iso-25010 maintainability.analysability
- cwe CWE-1357

Taxons: code-quality

HTML version: https://auditbuffet.com/patterns/ab-000676