Lockfile Ofrenda: candles for the packages that stopped speaking

Description and use

Lockfile Ofrenda visualizes dormant npm packages in a lockfile as candles. Clicking a candle triggers a local Gemma model to generate a remembrance, which is fact‑checked; if the model fails, a clerk copy of registry data is shown.

Problem

Developers need to identify and acknowledge npm packages in their lockfile that are unpublished, deprecated, silent for two years, or have no maintainers, because npm outdated does not reveal these issues.

Outcome

The app provides a visual and interactive way to identify and acknowledge quiet npm packages, ensuring developers are aware of potentially problematic dependencies without uploading data to external services.

Workflow

• Parse package-lock.json (v2/v3 or nested dependencies tree).
• Query registry.npmjs.org for each package’s last publish date, deprecation text, and maintainers.
• Score packages as quiet if unpublished, deprecated, silent for ≥730 days, or have no maintainers.
• Render an altar UI with a candle for each quiet package.
• On candle click, invoke local Gemma (via Ollama) to generate a remembrance slip.
• Ground the generated text against the registry facts; if it contains invented data, discard and show clerk copy.
• Allow user to snuff a candle to suppress future reminders in the session.

Evidence

The app parses npm lockfile v2/v3 (and the older nested dependencies tree), asks registry.npmjs.org for last publish, deprecation text, and maintainers, then lights a marigold candle for anything unpublished, deprecated, silent for 730 days, or listed with no maintainers.

Source

If Gemma is offline or fails that check, you get a clerk’s copy of the registry fields instead, labeled as such.

Source

The system prompt is a clerk of a death register, not a poet with a search engine.

Source