None of this dependencies are actually required for the module to function but including them in dependencies instead of devDependencies means they'll get installed - extraneously - alongside your module and potentially trigger security warning such as #1 .
https://github.com/jeescu/express-request-queue/blob/b419eb4e127b90d89f9119bc92dbd43e7bdae8fa/package.json#L27-L34
None of this dependencies are actually required for the module to function but including them in
dependencies
instead ofdevDependencies
means they'll get installed - extraneously - alongside your module and potentially trigger security warning such as #1 .