  JavaScript packages are notoriously prone to bloat, a factor that
significantly impacts the performance and maintainability of web applications.
While web bundlers and tree-shaking can mitigate this issue in client-side
applications at the function level, they cannot effectively detect and remove
bloat in server-side applications. In this paper, we conduct an empirical study
to investigate the bloated dependencies that are entirely unused within
server-side applications. Our study focuses on applications built with the
widely used and highly dynamic CommonJS module system. We propose a trace-based
dynamic analysis that monitors file access, to determine which dependencies are
not accessed during runtime. To conduct our study, we curate an original
dataset of 92 CommonJS packages with a median test coverage of 96.9% and a
total of 50,661 dependencies. Our dynamic analysis identifies and successfully
removes 50.7% of these dependencies while maintaining the correct build of all
packages. Furthermore, we find that 14.9% of directly used dependencies and
51.3% of indirect dependencies are bloated. A key insight is that focusing on
removing only the direct bloated dependencies by cleaning the package.json
file, also removes a significant share of unnecessary bloated indirect
dependencies. Compared to the state-of-the-art dynamic debloating technique,
our analysis based on file accesses has fewer false positives, and demonstrates
higher accuracy in detecting bloated dependencies. Our findings suggest that
native support for dependency debloating in package managers could
significantly alleviate the burden of maintaining dependencies.
