No unnecessarily large packages where lighter alternatives exist
Why it matters
Bundle size directly affects Time to Interactive, Core Web Vitals scores, and user-perceived performance — all of which influence both conversion rates and Google search ranking. A 67KB gzipped moment import on a page that formats one date adds payload weight that could instead be eliminated by a two-line switch to dayjs. Beyond performance, heavy packages often bundle more code than you use, increasing the attack surface of your client-side JavaScript: a compromise of the package affects all the functionality bundled in, not just the features you call. The ISO 25010 performance-efficiency characteristic explicitly covers minimizing resource consumption relative to functional requirements.
Severity rationale
Low because heavy packages degrade performance rather than introduce direct security vulnerabilities, but they measurably increase bundle size, slow page loads, and expand client-side attack surface.
Remediation
Replace known heavy packages with lighter equivalents. Moment to Day.js:
npm uninstall moment
npm install dayjs
// before
import moment from 'moment'
moment().format('YYYY-MM-DD')
// after
import dayjs from 'dayjs'
dayjs().format('YYYY-MM-DD')
For lodash, switch to per-function imports instead of the full library:
// before — imports entire 71KB lodash
import _ from 'lodash'
_.debounce(fn, 300)
// after — imports only debounce
import debounce from 'lodash/debounce'
debounce(fn, 300)
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Dependency & Supply Chain Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · performance-efficiency — Performance Efficiency characteristic
Taxons
History
- 2026-04-18·v1.0.0·Initial import from dependency-supply-chain·automated