重新运行npm init --yes后出现陌生依赖是否正常？

我在TypeScript项目中重新运行npm init --yes生成package.json，结果发现里面多了一堆不认识的依赖。我原本以为这个命令不会安装任何依赖，也记不清自己装过这些内容，想问问这种情况是否正常。项目是TypeScript开发的，当前npm版本是9.5.0。

生成的package.json内容如下：

{
    "name": "my-app",
    "version": "1.0.0",
    "description": "description",
    "main": "index.js",
    "dependencies": {
      "aggregate-error": "^3.1.0",
      "ansi-colors": "^4.1.3",
      "ansi-escapes": "^4.3.2",
      "ansi-regex": "^5.0.1",
      "ansi-styles": "^4.3.0",
      "arch": "^2.2.0",
      "asn1": "^0.2.6",
      "assert-plus": "^1.0.0",
      "astral-regex": "^2.0.0",
      "async": "^3.2.4",
      "asynckit": "^0.4.0",
      "at-least-node": "^1.0.0",
      "aws-sign2": "^0.7.0",
      "aws4": "^1.12.0",
      "balanced-match": "^1.0.2",
      "base64-js": "^1.5.1",
      "bcrypt-pbkdf": "^1.0.2",
      "blob-util": "^2.0.2",
      "bluebird": "^3.7.2",
      "brace-expansion": "^1.1.11",
      "buffer": "^5.7.1",
      "buffer-crc32": "^0.2.13",
      "cachedir": "^2.3.0",
      "caseless": "^0.12.0",
      "chalk": "^4.1.2",
      "check-more-types": "^2.24.0",
      "ci-info": "^3.7.1",
      "clean-stack": "^2.2.0",
      "cli-cursor": "^3.1.0",
      "cli-table3": "^0.6.3",
      "cli-truncate": "^2.1.0",
      "color-convert": "^2.0.1",
      "color-name": "^1.1.4",
      "colorette": "^2.0.19",
      "combined-stream": "^1.0.8",
      "commander": "^5.1.0",
      "common-tags": "^1.8.2",
      "concat-map": "^0.0.1",
      "core-util-is": "^1.0.2",
      "cross-spawn": "^7.0.3",
      "cypress": "^11.2.0",
      "dashdash": "^1.14.1",
      "dayjs": "^1.11.7",
      "debug": "^4.3.4",
      "delayed-stream": "^1.0.0",
      "ecc-jsbn": "^0.1.2",
      "emoji-regex": "^8.0.0",
      "end-of-stream": "^1.4.4",
      "enquirer": "^2.3.6",
      "escape-string-regexp": "^1.0.5",
      "eventemitter2": "^6.4.7",
      "execa": "^4.1.0",
      "executable": "^4.1.1",
      "extend": "^3.0.2",
      "extract-zip": "^2.0.1",
      "extsprintf": "^1.3.0",
      "fd-slicer": "^1.1.0",
      "figures": "^3.2.0",
      "forever-agent": "^0.6.1",
      "form-data": "^2.3.3",
      "fs-extra": "^9.1.0",
      "fs.realpath": "^1.0.0",
      "get-stream": "^5.2.0",
      "getos": "^3.2.1",
      "getpass": "^0.1.7",
      "glob": "^7.2.3",
      "global-dirs": "^3.0.1",
      "graceful-fs": "^4.2.10",
      "has-flag": "^4.0.0",
      "http-signature": "^1.3.6",
      "human-signals": "^1.1.1",
      "ieee754": "^1.2.1",
      "indent-string": "^4.0.0",
      "inflight": "^1.0.6",
      "inherits": "^2.0.4",
      "ini": "^2.0.0",
      "is-ci": "^3.0.1",
      "is-fullwidth-code-point": "^3.0.0",
      "is-installed-globally": "^0.4.0",
      "is-path-inside": "^3.0.3",
      "is-stream": "^2.0.1",
      "is-typedarray": "^1.0.0",
      "is-unicode-supported": "^0.1.0",
      "isexe": "^2.0.0",
      "isstream": "^0.1.2",
      "jsbn": "^0.1.1",
      "json-schema": "^0.4.0",
      "json-stringify-safe": "^5.0.1",
      "jsonfile": "^6.1.0",
      "jsprim": "^2.0.2",
      "lazy-ass": "^1.6.0",
      "listr2": "^3.14.0",
      "lodash": "^4.17.21",
      "lodash.once": "^4.1.1",
      "log-symbols": "^4.1.0",
      "log-update": "^4.0.0",
      "lru-cache": "^6.0.0",
      "merge-stream": "^2.0.0",
      "mime-db": "^1.52.0",
      "mime-types": "^2.1.35",
      "mimic-fn": "^2.1.0",
      "minimatch": "^3.1.2",
      "minimist": "^1.2.7",
      "ms": "^2.1.2",
      "npm-run-path": "^4.0.1",
      "once": "^1.4.0",
      "onetime": "^5.1.2",
      "ospath": "^1.2.2",
      "p-map": "^4.0.0",
      "path-is-absolute": "^1.0.1",
      "path-key": "^3.1.1",
      "pend": "^1.2.0",
      "performance-now": "^2.1.0",
      "pify": "^2.3.0",
      "pretty-bytes": "^5.6.0",
      "proxy-from-env": "^1.0.0",
      "psl": "^1.9.0",
      "pump": "^3.0.0",
      "punycode": "^2.1.1",
      "qs": "^6.5.3",
      "request-progress": "^3.0.0",
      "restore-cursor": "^3.1.0",
      "rfdc": "^1.3.0",
      "rimraf": "^3.0.2",
      "rxjs": "^7.8.0",
      "safe-buffer": "^5.2.1",
      "safer-buffer": "^2.1.2",
      "semver": "^7.3.8",
      "shebang-command": "^2.0.0",
      "shebang-regex": "^3.0.0",
      "signal-exit": "^3.0.7",
      "slice-ansi": "^3.0.0",
      "sshpk": "^1.17.0",
      "string-width": "^4.2.3",
      "strip-ansi": "^6.0.1",
      "strip-final-newline": "^2.0.0",
      "supports-color": "^8.1.1",
      "throttleit": "^1.0.0",
      "through": "^2.3.8",
      "tmp": "^0.2.1",
      "tough-cookie": "^2.5.0",
      "tslib": "^2.4.1",
      "tunnel-agent": "^0.6.0",
      "tweetnacl": "^0.14.5",
      "type-fest": "^0.21.3",
      "typescript": "^4.9.4",
      "universalify": "^2.0.0",
      "untildify": "^4.0.0",
      "uuid": "^8.3.2",
      "verror": "^1.10.0",
      "which": "^2.0.2",
      "wrap-ansi": "^7.0.0",
      "wrappy": "^1.0.2",
      "yallist": "^4.0.0",
      "yauzl": "^2.10.0"
    },
    "devDependencies": {},
    "scripts": {
      "test": "echo \"Error: no test specified\" && exit 1"
    },
    "keywords": [],
    "author": "",
    "license": "ISC"
}

补充说明：我原本的devDependencies内容是：

{
    "devDependencies": {
        "@cypress/xpath": "^2.0.3",
        "cypress": "11.2",
        "typescript": "^4.9.4"
    }
}

原因分析 #

npm init --yes本身确实不会安装依赖，它只是生成基础的package.json模板。你遇到的情况，大概率是因为npm的一个已知行为：当你在已有node_modules目录的项目中重新运行npm init --yes时，npm会自动将当前node_modules中所有已安装包（包括依赖的依赖）都写入package.json的dependencies字段里，而不是保留原有的依赖结构。

从你的依赖列表能看到，里面包含了cypress、typescript以及它们的所有子依赖——这些都是你之前作为devDependencies安装的包，现在被错误地移到了dependencies中。

解决办法 #

1. 恢复原有的package.json结构：
   • 先备份当前的package.json，然后将dependencies里的内容替换回你原本的devDependencies配置，再把不需要的依赖全部移除。
   • 执行npm install重新安装，确保依赖结构正确。
2. 避免再次触发这个问题：
   • 如果需要重新生成package.json，先删除node_modules目录和package-lock.json（或yarn.lock），再运行npm init --yes，之后重新安装所需依赖。
   • 或者直接手动修改package.json，不要用npm init --yes覆盖已有配置。

验证方法 #

可以在一个空目录中运行npm init --yes，你会看到生成的package.json里dependencies是空的，这才是正常行为，也能印证上述结论。

内容的提问来源于stack exchange，提问作者KiritoLyn