Who does open source actually depend on? I scanned the 433 most-starred JS repos

Описание и применение

Инструмент @genamed/busfactor позволяет быстро определить, какие npm‑пакеты в проекте зависят от одного автора, выявить устаревшие зависимости и найти заменители, тем самым снижая риск отказа сборки.

Задача

Modern JavaScript projects rely on hundreds of npm packages, many of which are maintained by a single individual or a dormant account, creating a high risk of build failure if that maintainer stops publishing.

Результат

The scan of 433 popular JS repos revealed that 98% contain at least one dead dependency, and a single maintainer (e.g., sindresorhus) is responsible for 99% of packages across the set. Many packages are owned by dormant accounts with no active publisher.

Рабочий процесс

• 1. Run npx @genamed/busfactor in the project root. 2. The tool reads the lockfile and queries npm and ecosyste.ms. 3. It reports per-package publish rights, deprecation status, last release, and funding links. 4. Aggregates results to show the most influential maintainers and overall bus factor. 5. Optionally use --md, --svg, or --fail-on dead for documentation or CI gating.

Доказательства

A median project installs 945 packages. Half of them have exactly one account that can publish.

Источник

98% of the repositories ship at least one dead dependency

Источник