谨慎直接 require 没有写进 package.json 的包

项目里明明没有声明一个包，代码却能 import 到它。换到干净环境，或者换一种安装方式，才报找不到模块。这种藏在依赖关系里的问题，通常被叫作幽灵依赖。

它不是 Node 凭空找出了一个包，而是安装布局让代码碰巧能访问到传递依赖。

用本地包构造同一份依赖关系

应用依赖 A，A 依赖 B，应用却直接 require B：

应用 -> A -> B
应用代码 -> require(B)  // 应用没有声明这一条依赖

新建一个空目录，将下面的脚本存为 install.mjs。脚本会在当前目录下创建 fixtures，打包两个本地包，然后分别安装；不会发布包，也不修改全局包管理器。

import { mkdir, writeFile, readFile } from "node:fs/promises";
import { spawnSync } from "node:child_process";
import { fileURLToPath } from "node:url";
import path from "node:path";
import assert from "node:assert/strict";
const root = process.cwd();
const fixtures = path.join(root, "fixtures");
function run(args, cwd, expect = 0) {
  const result = spawnSync(process.platform === "win32" ? "npm.cmd" : "npm", args, {
    cwd,
    encoding: "utf8",
    shell: process.platform === "win32",
  });
  if (result.status !== expect)
    throw new Error(result.stderr || result.stdout || String(result.error));
  return result.stdout;
}
async function json(file, value) {
  await writeFile(file, JSON.stringify(value, null, 2));
}
const b = path.join(fixtures, "b"),
  a = path.join(fixtures, "a");
await mkdir(b, { recursive: true });
await mkdir(a, { recursive: true });
await json(path.join(b, "package.json"), {
  name: "leyla-fixture-b",
  version: "1.0.0",
  main: "index.cjs",
});
await writeFile(path.join(b, "index.cjs"), "module.exports='B';\n");
run(["pack", "--ignore-scripts", "--json"], b);
const bTar = path.join(b, "leyla-fixture-b-1.0.0.tgz").replaceAll("\\", "/");
await json(path.join(a, "package.json"), {
  name: "leyla-fixture-a",
  version: "1.0.0",
  main: "index.cjs",
  dependencies: { "leyla-fixture-b": "file:" + bTar },
});
await writeFile(
  path.join(a, "index.cjs"),
  "module.exports=require('leyla-fixture-b');\n",
);
run(["pack", "--ignore-scripts", "--json"], a);
const aTar = path.join(a, "leyla-fixture-a-1.0.0.tgz").replaceAll("\\", "/");
const results = [];
for (const manager of ["npm", "pnpm"]) {
  const app = path.join(fixtures, manager + "-app");
  await mkdir(app, { recursive: true });
  await json(path.join(app, "package.json"), {
    name: manager + "-app",
    version: "1.0.0",
    dependencies: { "leyla-fixture-a": "file:" + aTar },
  });
  if (manager === "npm")
    run(["install", "--ignore-scripts", "--no-audit", "--no-fund"], app);
  else
    run(
      [
        "exec",
        "--yes",
        "--package=pnpm@8.15.9",
        "--",
        "pnpm",
        "install",
        "--ignore-scripts",
        "--store-dir",
        ".store",
      ],
      app,
    );
  await writeFile(
    path.join(app, "probe.cjs"),
    "try { console.log(require('leyla-fixture-b')); } catch { process.exitCode=3; }\n",
  );
  const result = spawnSync(process.execPath, ["probe.cjs"], {
    cwd: app,
    encoding: "utf8",
  });
  results.push({ manager, exit: result.status, output: result.stdout.trim() });
  assert.equal(result.status, manager === "npm" ? 0 : 3);
}

console.log(results);