Where do libraries come from that are in npm-shrinkwrap but don't correspond to package.json

Question

I have an npm-shrinkwrap file with express in it as a main dependency.

However,

• I don't have express as a dependency in my package.json file.
• I don't see it used in my project anywhere.
• I don't see it as a dependency of something else in npm-shrinkwrap which is what I would expect.

These are the possible reasons I can think of for it existing...

I've run the following and the library is still there:

npm prune
npm shrinkwrap

I ended up finding the dependency somewhere in node_modules but shouldn't it be listed as a dependency of that library in npm-shrinkwrap if it isn't explicitly a dependency of the project?

Answer 1

Your package.json just lists your dependencies. But the packages you are using do have dependencies themselves. One of your packages is using express, which is why its in you node_modules folder.