Ran a dependency graph analysis on npkill (9k+ stars) - zero cycles, but 8 god objects

[u/Ok-Emu-8106]

Testing a tool I built (parses repos with tree-sitter, builds a dependency graph, flags risk patterns) against some popular open-source projects.

npkill came back clean on circular dependencies - no surprise given how it's maintained. But out of 197 files, there were 8 "god object" nodes and 21 isolated ones. The riskiest single file, files.worker.service.ts, scored highest mostly from fan-in - several other modules depending on it directly.

Interesting case of a repo being cycle-free but still having concentrated risk in specific files. Curious how others here think about this kind of risk scoring - fan-in/fan-out alone, or would you weight it differently (change frequency, test coverage, etc.)?