The worst offender, IMO, is request.  I&#x27;ve seen more than a few projects pull it in just to make a single HTTP call.  Just look at its package.json:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;request&#x2F;request&#x2F;blob&#x2F;master&#x2F;package.json" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;request&#x2F;request&#x2F;blob&#x2F;master&#x2F;package.json</a>