ZERO DEPENDENCY

In 2016 a developer unpublished left-pad, eleven lines that pad a string, and broke Babel, React, and thousands of builds across the internet.^[8][9] The lesson everyone took was "don't let one package vanish." The lesson nobody took was "why did a string-padding function need to be a package?"

Ten years later the answer is worse than we thought. The average npm project carries 49 direct and 79 transitive dependencies.^[6] Count the full tree and a modern web app pulls in 1,200 or more.^[7] Roughly 16.8% of all npm packages are trivial one-liners, and the proportion keeps rising.^[10] We outsourced String.padStart() to a stranger and called it engineering.

Then the bill came due. In September 2025, an attacker phished the maintainer of chalk and debug, utilities with a combined 2.6 billion weekly downloads, and shipped a crypto-clipper that rewrote wallet addresses in memory.^[2] Days later the industry met Shai-Hulud, the first self-replicating npm worm: it stole tokens, republished itself into other packages, and hit around 500 of them before anyone caught up.^[3] And in 2024 the world came within one code review of catastrophe when a patient attacker spent two years earning maintainer trust on xz, a compression library run by a single unpaid volunteer, and planted an SSH backdoor that nearly shipped to every Linux server on earth.^[4]

Now add the accelerant. Roughly 46% of new code on GitHub is AI-generated, and between 45% and 62% of it ships with a known class of vulnerability.^[11][12] Worse, the models invent dependencies: across 576,000 samples, 19.7% of the packages AI suggested did not exist.^[13] The fake names repeat, so attackers pre-register them and wait, a supply-chain attack where the victim never even makes a typo. The machine does it for them.^[14]

Zero Dependency is a 72-hour hackathon with one rule underneath everything else: the dependency manifest ships empty. Standard library only. Build a real tool, a parser, a server, a datastore, a password manager, the way you would have before we forgot how. Every line is yours. Nothing to audit but your own craft.

The antidote to "the AI added a package that doesn't exist" is adding no packages at all. You have 72 hours.

A working tool with an empty manifest. Not a proof of concept. Not a slide deck.

A working, useful program. It builds with one command and does something a real person would want. "Technically zero-dep but does nothing" is not the assignment.

An empty dependency manifest, verifiable on sight: package.json deps {}, empty requirements.txt, go.mod with no require, Cargo.toml with no dependencies.

A dependency proof. The output of the command that lists your dependencies (or your CI log), showing zero third-party runtime deps. Make it trivial for a judge to confirm.

Honest documentation. A STDLIB.md that names each package you would normally have installed and the standard-library feature you used instead. This is the receipt that makes the constraint judgeable, and it counts toward your score.

You'll submit:

• →Public GitHub repo with the tool
• →Build command that produces a runnable artifact in one step
• →Empty dependency manifest for your language
• →Dependency proof (command output or CI log showing zero third-party deps)
• →README.md: what it does, how to run it, its limits
• →STDLIB.md: every stdlib-for-package substitution you made
• →5-minute demo video showing the tool working and the manifest being empty

Public registries catalogued 454,600 new malicious packages in 2025, pushing the cumulative total past 1.2 million, a 75% jump, against 9.8 trillion open-source downloads.^[1] The chalk and debug compromise put a crypto-clipper inside utilities with 2.6 billion weekly downloads.^[2] Shai-Hulud became the first npm worm to replicate itself across packages.^[3] The xz backdoor showed that the whole edifice can rest on a single unpaid maintainer, two years of manufactured trust, and one obfuscated commit.^[4] And years-old holes stay open: Log4Shell was still downloaded 42 million times in 2025, 13% of them the versions with the known hole.^[5]

Meanwhile the tooling meant to save us is drowning us. 65% of teams admit to bypassing or delaying dependency fixes because of alert fatigue.^[15] The automated fixer resolves less than half of what it flags for most teams.^[16] So the alerts get an || true and the vulnerabilities ship.

And now the machine writing half our code^[11] reaches for a dependency by reflex, sometimes one that doesn't exist, until an attacker makes it exist.^[13][14] Generating code that imports ten packages is trivial. Building something real that imports none is the skill worth proving. That's the hackathon.