@performant-software/shared-components exports an Analytics component built on react-ga4, and the package.json declares no sideEffects field. Without that flag, bundlers can't tree-shake the barrel (dist/index.es.js), so importing anything from the package pulls in the bundled react-ga4 module — including its runtime gtag injector:

n.src = `https://www.googletagmanager.com/gtag/js?id=${e}`

Observed in FairData Sites (core-data-places 3.1.25): the site has no analytics code at all, but a 1.7 MB public _astro chunk contains the GA4 loader on every deployed site. Clients do inspect our shipped bundles (a university infosec team recently reviewed one), and an analytics loader that's never used is exactly the kind of thing that raises questions.

Suggested fix, either or both:

• Add "sideEffects": false to shared-components' package.json (assuming the modules are side-effect-free — the dist is already built with preserved module structure, so tree-shaking should then drop it).
• Make react-ga4 a lazy import() inside the Analytics component so only consumers that render it pay for it.

Found by the new dhtools fds inventory bloat census (dhtools#15).