What is 'dead code elimination' or 'tree shaking' in modern JavaScript bundlers and why does it matter for security?

• A.Tree shaking statically analyzes import/export graphs to remove code that is never called - reducing bundle size. Security relevance: (1) Smaller bundles have less attack surface - unused code paths (including vulnerable library functions) are not shipped to users; (2) Dependency confusion - if a sensitive utility is tree-shaken out, its vulnerable version may be included transitively but never executed; (3) Dead code may still contain credentials or sensitive logic that ships to clients if not eliminated. Effective tree shaking requires ES module syntax (import/export) not CommonJS (require)
• B.Tree shaking encrypts unused code paths before shipping the bundle so that attackers may not read them. Security relevance: (1) Encrypted modules are unreadable in DevTools, since the bundler stores the key on the build server; (2) Vulnerable functions are neutralized because the cipher blocks their execution, so a library with a known CVE is harmless once shaken; (3) Credentials in dead code are protected only if the cipher uses a strong key. It works with CommonJS (require) as well as ES modules, so no module syntax change is needed