What is nulldeps and how does it work?

Nulldeps is a zero-dependency JS micro-framework for web apps, offering Web Components, routing, reactive state, EventBus, and HTTP client—all vanilla JS, no npm or build tools needed. Drop the script tag, extend HTMLElement, and build.

Does nulldeps prevent supply chain attacks?

Yes, by eliminating npm and node_modules entirely—no external deps means no hijack vectors like the axios incident. You control every line.

Can nulldeps handle large-scale apps?

It scales for disciplined teams via Web Components and manual reactivity, but lacks ecosystem tools—best for MVPs, secure environments, or when avoiding bloat.

🛠️ Developer Tools

Nulldeps: The JS Framework That Erases npm — And Reshapes Web Dev Security

Everyone thought JS frameworks needed npm's vast ecosystem to thrive. Then the axios hijack hit, exposing 300 million downloads to risk—and sparking nulldeps, a zero-dependency alternative that flips the script on web dev.

theAIcatchup Apr 09, 2026 3 min read

Nulldeps live demo dashboard with Web Components and reactive UI

⚡ Key Takeaways

Nulldeps eliminates npm risks post-axios hijack with zero deps, no build step. 𝕏
Gains control and security but loses ecosystem conveniences like Tailwind. 𝕏
Ideal for secure, minimal apps; revives pre-npm discipline in modern JS. 𝕏

Published by

theAIcatchup

Community-driven. Code-first.

#JavaScript micro-framework #javascript framework #npm security #npm supply chain attacks #nulldeps #supply chain attacks #vanilla JS framework #zero dependencies #zero dependencies JS framework #zero dependencies framework

Worth sharing?

Get the best Open Source stories of the week in your inbox — no noise, no spam.

Originally reported by Dev.to

⚡ Key Takeaways

The 60-Second TL;DR

theAIcatchup

Share this article

Worth sharing?

Related Stories

OpenClaw's 135K Exposed Agents: A Ticking Time Bomb

Fairwords NPM Worm Steals Credentials, Hijacks Your Other Packages, and Jumps to PyPI

This Merge Gate Quizzes Devs on Their Own Code — And It's Genius Stateless Engineering

Crane Ledger's Headless API: Finally, Accounting Without the UI Shackles

Stay in the loop