Is having two libraries for one job ever justified?

Sometimes, briefly, during a migration. That is why the scan thresholds at three — a deliberate two-library transition is common and not flagged, while three signal accumulation without a plan.

Which group's packages are checked?

Five evidence-backed groups: date handling, HTTP clients, input validation, client-side state, and charting. These are the jobs where agents most often stack libraries.

Does the scan penalize a wrapper around another library?

Yes — a wrapper and the wrapped library still count as two packages for the same job. If the pair alone keeps a group under three, it is not flagged, but consolidating is still the cleaner end state.

AI code debt

Dependency Sprawl Check — Do Multiple Packages Do the Same Job?

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.

What the issue is

Three or more packages solving the same job means duplicate behavior, duplicated security surface, and version conflicts over the same feature. It is one of the clearest signs a codebase was assembled by adding, never consolidating.

Why AI tools generate it

Agents add the library they know per feature without checking the manifest. Validation, dates, and HTTP each accumulate two, then three packages, and the next agent adds a fourth because the mess makes each choice look undecided.

How DevMeth detects it

The scan knows the well-known packages for five job groups (date handling, HTTP clients, input validation, client-side state, charting), counts how many each project declares, and reports a group once it reaches three.

What a finding looks like

Medium

Three or more packages do the same job — overlapping dependencies for one task

WHAT WE FOUND

package.json — moment + dayjs + date-fns — three date libraries

Sample — illustrative and masked exactly as a real report shows it. Run a free scan to see your own results.

The fix, in three steps

Choose one package per job group, migrate the usages to it, and remove the losers from the manifest. One implementation per job is the target.

Run a free scan and each finding carries a paste-ready fix prompt you can act on.

Maintainability findings ship in the Rescue Report — bundled with the Launch Pack or available on its own.

Try a free scan

FAQ

DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.