No dev dependencies serving production runtime roles

A runtime package in devDependencies will silently disappear when your deployment runs npm install --production or NODE_ENV=production — causing runtime crashes that only surface in production, not local development or CI. Conversely, build tools like jest, eslint, and typescript in dependencies bloat your production install, increase container image sizes, and expand the attack surface of your production environment with tooling that was never meant to be deployed. OWASP A06 applies when the wrong set of packages is present in the production environment. CWE-1357 covers unnecessary components in the production software composition. SSDF PW.4 requires that the production component set be intentionally defined and reviewed.

Move packages to the correct section using the explicit save flags:

# Move a runtime package from devDependencies to dependencies
npm install package-name --save-prod

# Move a build tool from dependencies to devDependencies
npm install package-name --save-dev

For Next.js and similar SSR frameworks: dependencies should include any package imported in server-side code, API routes, or middleware — not just client-side imports. The --omit=dev flag in production installs skips devDependencies entirely, so anything imported at runtime must be in dependencies.