October 29, 2026 at 8:16:21 PM UTC

	Since	posts	replies	likes	reposts and quotes	views
Bluesky	May 2023	1,039	8,236	23,127	2,380
Mastodon	Nov 2022	2,399	29,156	55,396	16,820
GitHub	Jul 2010	179	5,777 3,520	33,866	3,317
npm	Jul 2014	139	1,546			75,991,720
YouTube	Dec 2015	30		1,203		32,713
Letterboxd	Mar 2026	55
Blog	Nov 2025	20
Hacker News	Jan 2011	59	575	802
All	Jul 2010	4,807	37,967	114,394	22,517	76,024,433

Worth remembering that Next.js internally bundles 136MB of dependencies in its package output (see https://npmx.dev/package-code/next/v/16.4.3/dist%2Fcompiled) so even though an npm audit (on v16.4.3) reports 0 vulnerabilities, it actually has 32 unreported (some might argue hidden) vulnerabilities.

Also posted to Bluesky.

13 replies

Conor 💻 Mastodon 34 min later

@zachleat Would pnpm be able to audit those better?
1. Zach Leatherman Mastodon 1 hr later
  
  @conr oh, I don’t know! I wouldn’t expect pnpm to look at package contents to try to find bundled deps, that seems like a costly practice!
  1. Conor 💻 Mastodon 1 hr later
    
    @zachleat
Jim Nielsen Bluesky 40 min later

some might argue.

not you, of course.

but some.
1. Jim Nielsen Bluesky 41 min later
  
  lol i'm sorry. that was tongue in cheek. idk what you think. i'm just typing nonsense into textareas on the internet
  1. Zach Leatherman Bluesky 51 min later
    
    aha no apologies necessary (it is what I think but I’m tired of javascript bros so I always leave myself a little wiggle room so that’s why I am replying to this via DM… wait)
Zach Leatherman Mastodon 1 hr later

Found this excellent article about this topic from @43081j https://e18e.dev/blog/bundling-dependencies
I might suggest adding `next` as an example here (and also maybe add one more benefit and drawback: explicit control of the supply chain)
Private reply Mastodon 3 hr later
Jean Carlos Morla · Conditec Bluesky 14 hr later

Este es el punto ciego de npm audit: solo ve el árbol declarado, no lo que va empaquetado dentro del build. Para equipos pequeños en LATAM que dependen de ese 0 vulnerabilidades como señal de salud, un SBOM del artefacto final da una imagen más honesta. ¿Lo usas en CI?
Tony Mottaz Mastodon 15 hr later

@zachleat and I think they’re monkey patching some stuff in this dependencies so… who knows how many vulnerabilities there actually are!
1. Zach Leatherman Mastodon 16 hr later
  
  @tonymottaz whoa, really!
  1. Tony Mottaz Mastodon 1 day later
    
    @zachleat yeah I remember a few years back that was definitely true for some React APIs, and I think they did some weird stuff with undici.
    1. Zach Leatherman Mastodon 1 day later
      
      @tonymottaz oh yes the fetch() monkey patch!