extra packages installed with bcrypt

Yes, that's exactly right. Just as your project becomes dependant on bcrypt for some of it's functionality, bcrypt is also dependant on other libraries. Software sharing communities like npm are like a great big web of dependencies with so much interconnection. It's fascinating, really. So when you install a package for your project, any of that package's dependencies are also going to be installed and live in another node_modules directory. This is a big reason why you never, ever want to commit your dependencies because they can grow almost exponentially. The code you wrote might be 1 megabyte, while your dependencies are half a gig. So if you aren't doing it already, always create a file in the root directory of your project called .gitignore and put node_modules in it. Git will see this file and automatically ignore any folders or files specified in it.