Your node_modules isn't yours. It's a crowd of strangers you invited in.
Every npm install is an act of trust. You vetted the package you typed; you didn't vet the hundreds of transitive packages that came with it, or the accounts that can publish the next version of each.
I built a zero-dependency CLI that reads package-lock.json and counts every npm account with publish rights in your tree. Then I ran it on famous repos.
The numbers
| repo | packages | strangers | top stranger's share |
|---|---|---|---|
| Kong/insomnia | 1,571 | 1,786 | 8.3% |
| axios/axios | 1,416 | 809 | 12.9% |
| microsoft/vscode | 1,179 | 710 | 10.3% |
| github/docs | 1,014 | 710 | 11.1% |
| npm/cli | 851 | 450 | 12.9% |
| microsoft/playwright | 632 | 390 | 18.7% |
| ionic | 491 | 340 | 21.2% |
Insomnia's tree has more strangers than packages: 1,786 people can ship code into an app that stores your API keys.
The account at the top of three of those lists is the same person. ljharb can publish into 12.9% of npm's own CLI, 10.3% of VS Code's install, and 18.7% of Playwright. One account, three supply chains. sindresorhus alone is 21% of Ionic's tree.
Half the tree is one person
Roughly 55% of packages in every tree I checked are maintained by exactly one account. Not a small team — one person with publish rights.
npm audit checks for known vulnerabilities in versions you already have. It says nothing about who can publish the next version. That list is your actual attack surface — the xz backdoor was one overworked maintainer with commit access to a package half the internet ran.
Try it
npx dep-census # your project's package-lock.json
npx dep-census owner/repo # any GitHub repo's lockfile
Zero dependencies, MIT, ~150 lines of logic. Full leaderboard in LEADERBOARD.md:
https://github.com/princejain756/dep-census
npm only for now — yarn and pnpm lockfiles aren't parsed yet, and it says so in the readme.
Top comments (0)