Should I install morgan logger as dev dependency

should i install morgan as a normal dependency or as devDependency since I'm not gonna use the logging in production mode anyway:

if (config.NODE_ENV !== 'production') {
    app.use(morgan('dev', { stream: { write: message => logger.http(message) } }));
}

Assuming that config.NODE_ENV matches the process.env.NODE_ENV and that you installed via npm install --production or similar, then you don't need to include morgan in your dependencies and can just have it in devDependencies. You should move the require or import inside the if statement to prevent errors. When you call require or import is when it tries to load from node_modules or the module cache if it was already loaded.

if (config.NODE_ENV !== 'production') {
    const morgan = require('morgan');
    app.use(morgan('dev', { stream: { write: message => logger.http(message) } }));
}

That said, I would personally include it in the dependencies and disable logging via a config setting in case I wanted to enable logging in my production environment to debug something.