Run npm install for one convenient package and watch your node_modules fill with dozens more. Each is code you now ship, trust and are exposed to. That is the hidden cost of the modern dependency tree — and it is why Lacspace made a rule: every package ships with a dependency tree of one — itself.
Faster installs, smaller bundles
No transitive tree means less to download, resolve, de-duplicate and bundle. Installs are quicker, cold starts on serverless are lighter, and what reaches the browser is only the code you actually use.
Fewer CVEs
The uncomfortable truth about npm security is that most incidents arrive through transitive dependencies — something buried in your tree that you never picked. Remove the tree and you remove that entire class of risk. And where cryptography is involved, Lacspace builds on the Web Crypto API — vetted, standard primitives — instead of hand-rolling, which is where crypto bugs are born.
Write once, run everywhere
Because the packages are written against Web-standard APIs, the same import runs on Node, on the edge, and in the browser. Every package ships dual ESM + CJS, so it works whether your project uses import or require.
The trade-off, honestly
Zero-dependency isn’t a dogma for its own sake — sometimes a big, well-maintained library is the right call. The point is that the small, universal building blocks every project reaches for shouldn’t drag a forest behind them. Those are exactly what Lacspace ships dependency-free.
See for yourself
Run npm view @lacspace/seo dependencies and you’ll get an empty object. Browse the full set at lacspace.com/packages and the docs at lacspace.com/docs.
Frequently asked questions
Why do zero dependencies matter?
Every dependency you add pulls in its own dependencies, and theirs — a tree that grows your install size, slows cold starts, and widens your supply-chain attack surface (each package is code you now trust). Zero-dependency packages avoid all of that: what you install is what runs.
Does zero-dependency mean fewer features?
No. It means the code is written against Web-standard APIs instead of leaning on other packages. Lacspace packages deliver full features — JWTs, PDFs, Excel export, spaced-repetition, virtual lists — with no third-party tree behind them.
What is an isomorphic package?
One that runs unchanged across runtimes — Node, edge functions and the browser — because it uses APIs all of them share (fetch, Web Crypto, streams). You write one import and it works everywhere, which is why Lacspace crypto uses the Web Crypto API rather than a Node-only or hand-rolled implementation.
Why dual ESM + CJS?
So the package works whether your project uses modern `import` (ESM) or classic `require` (CommonJS). Every Lacspace package ships both builds, so you never hit the “cannot use import statement” or “require is not defined” wall.
How does this improve security?
Most real-world npm incidents come through transitive dependencies — a package deep in your tree that you never chose. With zero third-party dependencies there is nothing transitive to compromise, and crypto is built on vetted platform primitives, never re-implemented.
