Who does open source actually depend on? I scanned the 433 most-starred JS repos

说明与用途

@genamed/busfactor CLI 让团队快速识别依赖单一维护者的 npm 包，发现已废弃的依赖并寻找替代品，从而降低构建失败风险。

问题

Modern JavaScript projects rely on hundreds of npm packages, many of which are maintained by a single individual or a dormant account, creating a high risk of build failure if that maintainer stops publishing.

结果

The scan of 433 popular JS repos revealed that 98% contain at least one dead dependency, and a single maintainer (e.g., sindresorhus) is responsible for 99% of packages across the set. Many packages are owned by dormant accounts with no active publisher.

工作流

• 1. Run npx @genamed/busfactor in the project root. 2. The tool reads the lockfile and queries npm and ecosyste.ms. 3. It reports per-package publish rights, deprecation status, last release, and funding links. 4. Aggregates results to show the most influential maintainers and overall bus factor. 5. Optionally use --md, --svg, or --fail-on dead for documentation or CI gating.

证据

A median project installs 945 packages. Half of them have exactly one account that can publish.

来源

98% of the repositories ship at least one dead dependency

来源