Yes. I keep two package.json files for my Node.js application. One has all the trillions of dev dependencies and the default one has almost no dependencies. This way my application does not trip any dependency security alarms.