Why webpack includes elliptic bn.js modules in my bundle

Question

webpack-bundle-analyzer shows elliptic and bn.js included in my vendor.js But these modules are not used in code or included in package.json.

npm ls bn.js gives:

├─┬ eslint-import-resolver-webpack@0.8.1
│ └─┬ node-libs-browser@1.1.1
│   └─┬ crypto-browserify@3.11.0
│     └─┬ browserify-sign@4.0.0
│       └── bn.js@4.11.6

Answer 1

Webpack includes elliptic and bn.js (and other, smaller modules) in your bundle if you import crypto as a dependency somewhere in your code.

To avoid these huge dependencies, you can look for a specific npm module which provides just the function(ality) you need.

For example, I was importing crypto to do;

const crypto = require('crypto');
const hmac = crypto.createHmac('sha1', buf);

... instead (in this situation...), you can install the create-hmac module, and do;

const createHmac = require('create-hmac');
const hmac = createHmac('sha1', buf);

In case you need some motivation; removing crypto as a dependancy trimmed 150Kb off our gzipped bundle size (but YMMV depending on which crypto methods you're using).

Answer 2

Those are dependencies of your dependencies. For example source