Installing grunt puts code from 32 people on my disk

The pitch for npm is small blocks. Write a module that does 1 thing, publish it, let other people assemble. I have repeated that pitch for months without ever counting what a single install actually puts on my disk.

The registry keeps the publish date of every version, so I can ask what each package looks like as of today rather than as of whenever I happen to run this. I took 6 roots I actually use, resolved each to its newest version published on or before today, then walked the dependency names to the bottom.

The spread between the smallest and the largest tree is 51 to 1. Request, the client everybody uses to talk to the outside world, is 1 file of nobody else's code.

Grunt is the outlier at 51 packages from 32 people. Express, which I would have guessed was the heavy one, brings 8. Request brings nothing at all. It is 1 package with no dependencies and a single maintainer, the thing I reach for whenever a program has to make an HTTP call.

The pitch is true

Across the 6 trees there are 67 distinct packages. 40 of them, a clear majority, declare no dependencies whatsoever. The median package in this graph depends on nothing, the heaviest depends on 16 others.

That is the small blocks idea working exactly as advertised. Most of what lands on my disk is somebody’s single file that parses a query string or walks a directory. It drags no world in behind it.

The part nobody puts on the slide

40 people wrote the graph. 3 of them wrote 39 percent of it. 84 percent of the packages have nobody standing behind them but the author.

56 of the 67 packages have exactly 1 maintainer. There is no second person with the rights to publish, which means a package is 1 lost password or 1 lost interest away from being stuck. That is not a hypothetical property of the design. It is the current state of the graph under 6 ordinary installs.

And the graph is less diverse than 40 names suggest. isaacs appears on 10 of the 67 packages, tjholowaychuk on 8, substack on 8. Those 3 hold 26 of the 67, which is 39 percent of everything the 6 installs put on my disk.

I do not read this as a scandal. Those 3 wrote the layer everybody needed and published it instead of keeping it, so the concentration describes who did the work. It describes my exposure at the same time.

What I did not check

The version ranges. I walked package names, not the ranges in the dependency lists, so the tree I counted is the shape of the graph rather than the exact set of tarballs a given install would fetch. For counting distinct packages and distinct people that makes no difference. For anything else it would.

The maintainer lists are also not perfectly historical. 63 of the 67 packages carry a maintainer list inside the published version, which is a snapshot from the day it went out. The other 4 do not, so for those I fell back to the list the registry shows now, which may have changed since.

And I did not open a single tarball, so I know how many packages arrive and from whom, while knowing nothing about how much code that actually is.

The narrow claim is that both halves of the pitch are measured now. Small blocks is real, because most of these packages depend on nothing. The cost of small blocks is also real: 6 installs bring 67 packages, with exactly 1 person standing behind 84 percent of them.