Yeah, that seems bonkers, but it’s how npm works. I don’t always code in JS, but if I do: a) its code that’s going to run in a browser and b) I never ever use any JS dependencies aside from browser builtins. It’s about the only way to opt out of the dependency nightmare that is “modern web dev”.
Ok, I lied a little bit. In my job, I sometimes do JS work on projects with Grunt, Bower, Backbone, jQuery and a gorillion other dependencies. But when I have full autonomy over a codebase like with my side projects, my style is as above.
To qualify that even more, even in my side projects, I often use minifiers, but not ones written in JS or pulled in via NPM.
Of course, that probably doesn’t help much when you have need of functionality that would be much less trivial to make yourself. Again at my job, we use JsBarcode to generate images of barcodes. That would be a royal pain to implement from scratch. If I needed that functionality in a side project, I’d probably just bite the bullet and pull it in from Bower with 30 other bulky dependencies. (Or more likely just refrain from taking on that particular side project. Or possibly generate barcodes server-side.)
Trusted computing is back in a new form. :\