Fifty Green Tests, Two Real Bugs, and the Oracle One `npm install` Away

A QR code cannot hide a bug from you, as checking it costs nothing. Simply point a phone at it, and a URL will either appear or it won't. This is why the author chose a QR encoder for a hackathon with strict rules: no packages, an empty dependency manifest, and verified before submission. They rebuilt qrcode, the library nearly every JavaScript project relies on, in 844 lines of Node and an empty dependency manifest.

However, by the end, they had only 50 tests that passed, and two bugs that went unnoticed. A phone detected the first bug in just four seconds, during the third day of testing.

Fortunately, a tool that could have found both bugs on the first afternoon was only one command away, but the author refused to use it, as running it felt like cheating. The QR encoder was easy, but the challenge lay in verification, which they also got wrong.

When examining what npm install qrcode actually installs, they found that it writes 29 packages to disk, totaling 2.4 MB. Three of these packages - qrcode, pngjs, and dijkstrajs - handle the actual work, while the remaining 26 are part of a command-line interface, such as yargs and its dependency tree, cliui, string-width, wrap-ansi, emoji-regex, y18n, camelcase, and down. These packages are installed on your server, regardless of whether you ever run qrcode from a terminal.

The author emphasizes that the number of dependencies was a fiction, as 29 was the actual count, not just one. They hadn't read any of the code, which is the typical situation for most Node services: thousands of strangers' code running as you, with minimal auditing. The term "dependency" is polite, but "borrowed trust" is more accurate. People are trusted because auditing them is more work than the feature is worth.

The hackathon's premise is that we borrow more than we need. So, how much of the 29 is essential? Most of it. The specification (ISO/IEC 18004) is a series of small, closed problems, such as Reed-Solomon error correction over GF(2⁸), the module matrix with finder squares and timing lines, eight mask patterns, and fifteen to eighteen bits of metadata wrapped in BCH codes.

None of these require anything outside the standard library. The author stopped at DEFLATE, which is itself a hackathon project, as zlib is part of the standard library. This is the single asterisk on zero dependencies. It's the opening line of their README and the last time they'll mention it, as it isn't where the story goes.