Reduce repository dependency bloat by auto-identifying and remediating unused or bulky packages

Many engineering organizations — from startups to large enterprises — are drowning in dependency bloat: repositories with hundreds of direct and transitive packages, dozens of single-purpose modules, and unclear ownership of transitive attack surface. This problem affects roughly 1.5 million development teams who shoulder direct costs (CI runtime, cache misses) and indirect costs (maintenance, security reviews), and it becomes acute for teams with frequent releases and tight compliance requirements. You could build a developer tool that automatically identifies unused or heavy packages and takes safe, auditable remediation actions: static analysis and optional runtime tracing to detect dead dependencies, byte-size and build-cost metrics for each package, transitive risk scoring, and automated pull requests that update manifests, lockfiles, and CI cache hints. With a go-to-market focused on integrations into CI/CD and package managers, the product could aim at a $3K ACV land-and-expand motion that maps to a $4.5B addressable market (1.5M teams × $3K). This market is attractive now because package ecosystems are growing rapidly, supply-chain security scrutiny is increasing, and teams are calorie-counting CI spend; those three trends create both urgency and measurable ROI for dependency trimming. To stand out from a medium-competition market you’ll need high-precision detection to avoid false positives, multi-language breadth, and a developer-friendly remediation UX — combining static and dynamic signals and shipping safe, test-backed pull requests rather than just reports. The strength is clear economics and regulatory tailwinds, but the real challenges are achieving high accuracy across ecosystems, minimizing developer friction, and proving value quickly in pilot projects.