[SOLVED] Where do libraries come from that are in npm-shrinkwrap but don't correspond to package.json

Where do libraries come from that are in npm-shrinkwrap but don't correspond to package.json

I have an npm-shrinkwrap file with express in it as a main dependency.

However,

I don't have express as a dependency in my package.json file.
I don't see it used in my project anywhere.
I don't see it as a dependency of something else in npm-shrinkwrap which is what I would expect.

These are the possible reasons I can think of for it existing...

I've run the following and the library is still there:

npm prune
npm shrinkwrap

I ended up finding the dependency somewhere in node_modules but shouldn't it be listed as a dependency of that library in npm-shrinkwrap if it isn't explicitly a dependency of the project?

Solution

Your package.json just lists your dependencies. But the packages you are using do have dependencies themselves. One of your packages is using express, which is why its in you node_modules folder.