Dependencies are imported efficiently
Why it matters
Barrel imports like import _ from 'lodash' or import AWS from 'aws-sdk' pull the entire library into the module graph at bundle time. Even with tree-shaking, not all packages are written to be tree-shakeable — lodash's default export is a single object, not named exports, so tree-shaking cannot eliminate the unused functions. The result is a client bundle that includes code paths you never call, increasing both payload size and the attack surface of your front-end JavaScript. The ISO 25010 performance-efficiency characteristic requires that resource use be proportional to functional demand; importing 71KB of utility functions to use three of them is a direct violation of that principle.
Severity rationale
Low because inefficient imports increase bundle size and attack surface but do not introduce direct security vulnerabilities — the impact is performance degradation and unnecessary client-side code exposure.
Remediation
Switch to per-function or modular imports. For lodash:
// before — imports entire library
import _ from 'lodash'
// after — imports only what you use
import debounce from 'lodash/debounce'
import throttle from 'lodash/throttle'
For AWS SDK, migrate from the monolithic v2 to the modular v3:
// before
import AWS from 'aws-sdk'
const s3 = new AWS.S3()
// after
import { S3Client, GetObjectCommand } from '@aws-sdk/client-s3'
const s3 = new S3Client({ region: 'us-east-1' })
For date-fns, named imports are already tree-shakeable — import { format } from 'date-fns' is fine as-is.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Dependency & Supply Chain Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · performance-efficiency — Performance Efficiency characteristic
Taxons
History
- 2026-04-18·v1.0.0·Initial import from dependency-supply-chain·automated