Zach Leatherman, who maintains 78 npm packages, built a personal dashboard called 'Is this still being maintained?' to track the health of his open source projects. The dashboard assigns each project a Neglect score based on popularity (npm downloads, GitHub stars), need (open issues, PRs, npm audits), and recency (publish and commit dates). Key findings: 67 million npm downloads in the past year, over 1.1k published versions, and notably only 11 total npm audit reports across 77 packages — a result he attributes to locking down publishing workflows and reducing dependencies. The most neglected package is the Eleventy Vue plugin, which accounts for 31 of his 42 total audit reports. The exercise also prompted him to archive old projects he no longer wants to track.
Questions this post answers
How do I track which of my npm packages need maintenance attention across a large portfolio?
One approach is building a personal dashboard that assigns each package a 'Neglect score' combining popularity (npm downloads, GitHub stars), need (open issues, PRs, npm audit reports), and recency (last publish date, last commit). A sparkline of publish frequency adds quick visual context. This makes it easy to spot which packages need immediate attention without manually checking each repository. Maintainers juggling many packages find relevant tooling and approaches discussed on daily.dev.
What is the relationship between npm dependency count and npm audit vulnerability reports?
Fewer production dependencies directly correlates with fewer npm audit reports. Across 77 packages with minimal dependencies, only 11 total audit reports were recorded. By contrast, the single most dependency-heavy package (Eleventy Vue plugin) alone accounted for 31 of 42 total audit reports — illustrating that reducing transitive dependencies is one of the most effective ways to lower security exposure. Teams working to reduce supply chain risk in their npm projects track strategies like this on daily.dev.