Only report packages with extraneous files

[jfmengels]

When listing the packages, I see that quite a few faulty ones (examples, all the lodash.XXX) do not have any extraneous dependencies files, yet no files setting or .npmignore.

Example: the content of node_modules/lodash.find is:

├── index.js
├── LICENSE
├── package.json
└── README.md

I suggest not reporting those as faulty by default, and to add an option to report those.

Thanks for the tool :)

[insin]

Agreed.

Seems like using "contains only files which match npm's default whitelist plus whatever's in package.json main" as an heuristic would cover avoiding false positives for the individual lodash modules and anything like them

[jfmengels]

Yes, that sounds pretty good to me.

The real problem will be with packages that have files or npmignore but that include unused files :D

[insin]

modclean has a bunch of different heuristics with different "safetly" levels which might be worth looking at.