Unused dependencies are identified
Why it matters
Unused production dependencies are pure supply chain liability: they represent packages that must be audited for CVEs, monitored for deprecation, and maintained through version upgrades — all while providing zero functionality. CWE-1357 applies directly: relying on more third-party components than your software requires increases the attack surface proportionally. SSDF PW.4 requires that the software composition be intentional and minimal. AI coding tools are the primary source of unused dependency accumulation — they install a package to explore an approach, then implement a different solution, but never run npm uninstall. The result is a package.json that describes a project that never existed.
Severity rationale
Info because unused dependencies do not themselves contain vulnerabilities in the running application, but they are pure supply chain overhead that increases audit burden without contributing any functionality.
Remediation
Identify and remove unused dependencies:
npx depcheck
Review the output carefully — depcheck reports false positives for packages loaded via dynamic imports, config files, or peer dependency mechanisms. For each confirmed unused package:
npm uninstall unused-package
Commit the updated package.json and lock file together. Add depcheck to a monthly engineering review cycle to prevent accumulation between audits.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Dependency & Supply Chain Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1357 — Reliance on Insufficiently Trustworthy Component
- ssdf:800-218 · PW.4 — Reuse Existing, Well-Secured Software
Taxons
History
- 2026-04-18·v1.0.0·Initial import from dependency-supply-chain·automated