I read 65 CI files from 30 popular npm packages. 13 still run an end‑of‑life Node

Description and use

The author examined 65 CI files from 30 popular npm packages and found that 13 still run tests on deprecated Node versions, posing security and compatibility risks.

Problem

Many popular npm packages still run tests on deprecated Node versions, misleading CI badge green status.

Outcome

Out of 65 CI files, 13 still run tests on Node versions that are no longer supported, exposing potential security and compatibility risks.

Workflow

• 1. Clone or fetch .github/workflows/*.yml from target repos
• 2. Parse YAML to extract Node matrix entries
• 3. Compare each Node version against current LTS support
• 4. Detect obsolete or invalid entries (e.g., missing matrix rows, wrong locale names)
• 5. Report findings with actionable suggestions

Evidence

Thirteen of those 65 files execute at least one end‑of‑life Node somewhere.

Source

Both files still call actions/checkout@v2 and actions/setup-node@v2. The current major is v7.

Source