Exposing the Hidden Cost of npm Dependencies: Size, Security, and Age

The CanisterWorm malware outbreak revealed how blind developers are to their node_modules contents. While existing tools only show one dimension—npm audit for vulnerabilities or Bundlephobia for bundle size—none provide a complete view combining installed size, security status, and maintenance recency. node-weight fills this critical gap by exposing how abandoned packages with high download counts are prime targets for supply chain attacks.