---
title: "Keep the dependency tree small · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/supply-chain/small-dependency-tree
id: APS-71
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1160
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep the dependency tree small

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-71
- Level: Recommended
- Chapter: [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)
- Rule: Count every package the app installs, including the dependencies of dependencies. Add a package only when the standard library or a few lines of your own cannot do the job.
- Check: The build counts the installed production packages and fails when the count passes the number recorded in the repository. A change that raises the number names each new package, direct or indirect, with a reason.
- How: Each package can run code on your build machines and in production, and so can every package it pulls in. Coding agents add packages fast, and attackers target small packages nobody watches. Every package you skip is one less way in. List the whole tree, not only the packages you named, with `npm ls --all` or `pipdeptree`. Before adding a package, count the packages it brings with it. Keep test and build tools out of the production install. For sensitive code, such as sign-in, payments or parsing uploads, let an agent write the small part you need. Or copy one function from an open source library, with its licence notice and its tests, instead of loading the whole library. Never write your own cryptography this way, as [use only standard cryptography](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/standard-cryptography.md) says. Check each package you keep as [review every new package](https://agentwranglers.se/playbook/application-security/supply-chain/review-new-packages.md) describes. Remove packages the code no longer imports, as [remove unused dependencies](https://agentwranglers.se/playbook/architecture/structure/remove-unused-dependencies.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { execSync } from 'node:child_process';
import { readFileSync } from 'node:fs';

const listed = execSync('npm ls --all --omit=dev --parseable', { encoding: 'utf8' }).trim().split('\n');
const installed = listed.length - 1;
const allowed = Number(readFileSync('dependency-budget.txt', 'utf8'));
if (installed > allowed) throw new Error(`${installed} production packages, budget ${allowed}. Name each new one, then raise the budget.`);
```

### Python example

```python
import json, pathlib, subprocess

tree = json.loads(subprocess.run(["pipdeptree", "--json"], capture_output=True, text=True, check=True).stdout)
allowed = int(pathlib.Path("dependency-budget.txt").read_text())
if len(tree) > allowed:
    raise SystemExit(f"{len(tree)} installed packages, budget {allowed}. Name each new one, then raise the budget.")
```

## Sources

- [OpenSSF Concise Guide for Evaluating Open Source Software](https://best.openssf.org/Concise-Guide-for-Evaluating-Open-Source-Software)
- [npm ls](https://docs.npmjs.com/cli/v11/commands/npm-ls)

## Related rules

- APS-56 [Use only standard cryptography](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/standard-cryptography.md) in Application security
- APS-70 [Review every new package](https://agentwranglers.se/playbook/application-security/supply-chain/review-new-packages.md) in Application security
- ARC-61 [Remove unused dependencies](https://agentwranglers.se/playbook/architecture/structure/remove-unused-dependencies.md) in Clean code and architecture

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/supply-chain/small-dependency-tree">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Review every new package](https://agentwranglers.se/playbook/application-security/supply-chain/review-new-packages.md)
- Next: [Wait a few days before taking new releases](https://agentwranglers.se/playbook/application-security/supply-chain/release-cooldown.md)
- [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)