We develop an application using npm with several third-party packages. Now we want to release our app to the public. That we have to reference the licenses of the packages should be self-evident. But this third-party packages are also using third-party packages itself. How should we handle this packages? Shall we include all of this "indirectly" used packages in our license notice also, or can we ignore them?
If the licences require you to reference them, then you should reference them all the way down. Your code still contains those other libraries, even if you're not importing them directly.
It's also worth checking that all of them are compatible with the way in which you intend to release your software.
Not all licenses require you to put any acknowledgement in your documentation.