One of our products at work is a JS SDK that our clients can install and use with npm install .... I was going through the package.json file and found that a package, socket.io-client was installed as a devDependency. But the SDK is using socket.io for an integral part of its working, and it obviously it's working for our clients. So, why is it working? Since, going by the documentation, devDependencies should not be installed when using npm install.