Every Node.js project accumulates vulnerable dependencies. The npm registry holds over 2.5 million packages, and researchers found 454,000 malicious or vulnerable packages uploaded in 2025 alone.

The problem: one Read, and the context fills up You ask Claude Code a simple question about a project. Claude decides it needs to "understand the file first", calls Read on a big log, a generated JSON ...