[rwbcxrz]

Most of the dependencies installed for a hello world React app are not runtime dependencies.

I don't know if there's a real "standard operating procedure" or not, but it seems to me that it's the responsibility of each project maintainer to evaluate the fitness of a particular dependency for that project.

Just like with every package manager that I've ever heard of, you're responsible for what you install. I'm sure you can get buggy packages with poor test coverage via apt-get install / brew install / gem install / whatever-else install.

[mcguire]

At what point does maintaining the code you have copied become easier than understanding and maintaining the transitive closure of your dependencies?