Who does open source actually depend on? I scanned the 433 most-starred JS repos

Description and use

The @genamed/busfactor CLI lets teams quickly identify npm packages that rely on a single maintainer, spot dead dependencies, and find replacements, reducing build failure risk.

Problem

Modern JavaScript projects rely on hundreds of npm packages, many of which are maintained by a single individual or a dormant account, creating a high risk of build failure if that maintainer stops publishing.

Outcome

The scan of 433 popular JS repos revealed that 98% contain at least one dead dependency, and a single maintainer (e.g., sindresorhus) is responsible for 99% of packages across the set. Many packages are owned by dormant accounts with no active publisher.

Workflow

• 1. Run npx @genamed/busfactor in the project root. 2. The tool reads the lockfile and queries npm and ecosyste.ms. 3. It reports per-package publish rights, deprecation status, last release, and funding links. 4. Aggregates results to show the most influential maintainers and overall bus factor. 5. Optionally use --md, --svg, or --fail-on dead for documentation or CI gating.

Evidence

A median project installs 945 packages. Half of them have exactly one account that can publish.

Source

98% of the repositories ship at least one dead dependency

Source