More Open Source Security episodes

Cleanup, Speedup, Levelup open source at e18e thumbnail

Cleanup, Speedup, Levelup open source at e18e

Published 10 Aug 2026

Duration: 35:08

"E18e enhances JavaScript by reducing dependencies, optimizing tools, and improving security, as seen in its work with Storybook, while promoting cleaner code and community collaboration."

Episode Description

Josh chats with James from e18e. This is a project that is working on improving Javascript packages by cleaning up, speeding up, and leveling up the d...

Overview

The E18e project focuses on improving the JavaScript ecosystem by enhancing performance, security, and maintainability of widely used tools and libraries. Key goals include reducing dependency bloat, optimizing performance, and modernizing outdated or unmaintained packages. A major focus is on high-impact tools like Storybook, where the project successfully reduced hundreds of dependencies to just 20 - 30 by removing unnecessary packages and replacing unmaintained ones, resulting in smaller install sizes, improved security, and easier maintenance.

The project emphasizes strategic dependency management by identifying critical points in the dependency tree where changes can have broad ripple effects. It advocates for upstream contributions to well-maintained projects while cautioning against counterproductive practices like inlining dependencies, which can lead to ghost dependencies, increased maintenance burdens, and security risks - especially when automated tools or LLMs bundle code without oversight. Performance improvements are pursued through benchmarking and optimization of tools like Prettier and Astro, with notable gains in speed and memory usage, benefiting developer experience and CI efficiency.

Beyond technical improvements, the project highlights the importance of people and collaboration in open source. It promotes respectful, communication-first contributions - encouraging contributors to engage with maintainers before submitting changes - and fosters a supportive community through platforms like Discord. The initiative also addresses the decline of meaningful collaborative spaces in open source, positioning E18e as a model for sustainable, community-driven ecosystem improvement through shared goals, mutual support, and collective effort.

What If

  • What if you audited a high-impact dev tool's dependency tree and led a cleanup?

    • Move: Pick a widely used tool (e.g., Astro, Vite, or ESLint) with >100k weekly downloads. Use npm ls and bundlephobia to map its dependency tree. Identify 2 - 3 unmaintained or redundant packages (e.g., glob vs fast-glob) and propose replacements or removals via a GitHub issue, referencing E18e's Storybook cleanup as precedent.
    • Why Now?: Dependency bloat is worsening - popular tools now pull in 200+ packages by default. CI times and security risks are rising. The E18e project has proven this work is feasible and welcome when approached collaboratively.
    • Expected Upside: Reduce install size by 10 - 30%, cut CI runtime, and shrink attack surface. If merged, your change scales to every project using the tool. Builds credibility and opens doors to upstream contributions.
  • What if you benchmarked and optimized a slow CLI tool for faster local development?

    • Move: Choose a common dev CLI (e.g., Prettier, ESLint, or a framework CLI). Run CPU and memory profiling (node --cpu-prof, --heap-prof) on a real-world codebase. Identify top 1 - 2 hot functions (e.g., file traversal, parsing). Optimize them - switch to faster primitives, debounce calls, or use streaming. Submit a PR with benchmarks showing improvement.
    • Why Now?: Dev tooling has silently gotten slower; modern laptops still choke on linting or formatting large repos. The E18e team showed 10x gains are possible (e.g., Prettier CLI). Users feel the pain daily, but few profile or fix it.
    • Expected Upside: 20 - 50% faster local runs improve developer experience across thousands of teams. Your PR becomes a reference for performance-first contributions. Positions you as a go-to optimizer in the ecosystem.
  • What if you created a lightweight alternative focused only on common use cases?

    • Move: Find a popular but bloated library (e.g., chalk, lodash, globby) where 80% of users need only basic features. Build a minimalist alternative (e.g., tiny-chalk, just-glob) using modern JS and built-ins (e.g., Node.js glob). Optimize for size, speed, and zero dependencies. Publish it and document benchmarks vs. the original.
    • Why Now?: E18e's shift toward optimizing common cases (e.g., tiny-globby) shows demand for lean tools. LLMs and bundlers worsen bloat; developers are seeking escape valves. The window is open for "less is more" alternatives.
    • Expected Upside: Attract users tired of bloat. If your package hits a nerve, it gets adopted in performance-sensitive projects or by tools looking to reduce deps. Can become a dependency of other optimized tools - scaling your impact.

Takeaway

  • Audit your most-used dependencies using npm ls or pnpm list to identify bloated or unmaintained packages, then prioritize replacing or removing them in your projects.
  • Before contributing code or opening PRs, contact maintainers of upstream open-source projects to discuss proposed changes, especially for dependency cleanup or performance improvements.
  • Focus optimization efforts on high-impact, widely-used tools (e.g., linters, bundlers, frameworks) where performance, memory, or bundle size improvements will compound across the ecosystem.
  • Avoid inlining third-party code to reduce dependencies; instead, advocate for or contribute to upstream updates to prevent maintenance debt and security risks from "ghost" dependencies.
  • Join targeted communities like the E18e Discord to collaborate with other developers, share optimization findings, and stay informed on ecosystem-wide efforts to modernize critical JavaScript tooling.

Recent Episodes of Open Source Security

3 Aug 2026 VulnCheck's State of Exploitation Report with Patrick Garrity

"Cybersecurity vulnerabilities are being exploited faster (80-day average), AI is both a tool and target, disclosure practices are inconsistent, and better coordination, transparency, and proactive patching are critical to mitigating risks."

27 Jul 2026 Securing critical infrastructure with Josh Corman

"Cybersecurity faces escalating threats to critical infrastructure, requiring stronger OT security, IT-OT collaboration, proactive threat modeling, and resilience engineering to prevent real-world disasters."

20 Jul 2026 Abandoned open source with Josh Marpet

"Outdated vendor risk management processes, plagued by misrepresented questionnaires and slow vulnerability disclosures, demand faster, proactive security measures and greater transparency in open-source software."

13 Jul 2026 Red Hat's Project Lightwell with Mo Duffy

"Project Lightwell uses AI and open-source collaboration to detect and fix vulnerabilities missed by traditional tools, emphasizing upstream transparency, AI's role in security, and Red Hat's efforts to sustain long-term open-source security through collaboration and patch adoption."

29 Jun 2026 AIBOM, CBOM, and HBOM with Allan Friedman

The evolution of Software Bill of Materials (SBOM) beyond manufacturing into cryptographic, hardware, and AI domains faces challenges in unified integration, compliance, tooling, and dependency tracking, requiring open-source collaboration, standardized frameworks, and adaptive policies to meet industry demands in procurement and risk management.

More Open Source Security episodes