Why webpack includes elliptic bn.js modules in my bundle

Question

webpack-bundle-analyzer shows elliptic and bn.js included in my vendor.js But these modules are not used in code or included in package.json.

npm ls bn.js gives:

├─┬ [email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └─┬ [email protected]
│       └── [email protected]

Answer 1

Webpack includes elliptic and bn.js (and other, smaller modules) in your bundle if you import crypto as a dependency somewhere in your code.

To avoid these huge dependencies, you can look for a specific npm module which provides just the function(ality) you need.

For example, I was importing crypto to do;

const crypto = require('crypto');
const hmac = crypto.createHmac('sha1', buf);

... instead (in this situation...), you can install the create-hmac module, and do;

const createHmac = require('create-hmac');
const hmac = createHmac('sha1', buf);

In case you need some motivation; removing crypto as a dependancy trimmed 150Kb off our gzipped bundle size (but YMMV depending on which crypto methods you're using).