--- title: "Am I neglecting my open source projects?—zachleat.com" url: https://daily.dev/posts/am-i-neglecting-my-open-source-projects-zachleat-com-abpnzherh source_url: https://www.zachleat.com/web/is-this-still-being-maintained type: article source: "Zach Leatherman" published: 2026-08-10T17:14:57.404Z updated: 2026-08-10T17:15:21.620Z tags: ["open-source", "npm", "web-components"] reading_time: 3 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Am I neglecting my open source projects?—zachleat.com **[Zach Leatherman](https://daily.dev/sources/zachleat)** · 3 min read · 0 upvotes · 0 comments ## Summary Zach Leatherman, who maintains 78 npm packages, built a personal dashboard called 'Is this still being maintained?' to track the health of his open source projects. The dashboard assigns each project a Neglect score based on popularity (npm downloads, GitHub stars), need (open issues, PRs, npm audits), and recency (publish and commit dates). Key findings: 67 million npm downloads in the past year, over 1.1k published versions, and notably only 11 total npm audit reports across 77 packages — a result he attributes to locking down publishing workflows and reducing dependencies. The most neglected package is the Eleventy Vue plugin, which accounts for 31 of his 42 total audit reports. The exercise also prompted him to archive old projects he no longer wants to track. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I track which of my npm packages need maintenance attention across a large portfolio? One approach is building a personal dashboard that assigns each package a 'Neglect score' combining popularity (npm downloads, GitHub stars), need (open issues, PRs, npm audit reports), and recency (last publish date, last commit). A sparkline of publish frequency adds quick visual context. This makes it easy to spot which packages need immediate attention without manually checking each repository. _Maintainers juggling many packages find relevant tooling and approaches discussed on daily.dev._ ### What is the relationship between npm dependency count and npm audit vulnerability reports? Fewer production dependencies directly correlates with fewer npm audit reports. Across 77 packages with minimal dependencies, only 11 total audit reports were recorded. By contrast, the single most dependency-heavy package (Eleventy Vue plugin) alone accounted for 31 of 42 total audit reports — illustrating that reducing transitive dependencies is one of the most effective ways to lower security exposure. _Teams working to reduce supply chain risk in their npm projects track strategies like this on daily.dev._ ## Similar posts on daily.dev - [Eleventy, 2025 in Review—zachleat.com](https://daily.dev/posts/eleventy-2025-in-review-zachleat-com-pz6zrdvqq) · Zach Leatherman · 0 upvotes · 0 comments - [Open Source is one person](https://daily.dev/posts/open-source-is-one-person-nwjhqugba) · Lobsters · 2 upvotes · 0 comments - [Dependency Hygiene](https://daily.dev/posts/dependency-hygiene-wk2t5wl36) · stitcher.io · 23 upvotes · 0 comments - [This Week in Package Management: 13 June 2026](https://daily.dev/posts/this-week-in-package-management-13-june-2026-umlsngmp0) · Andrew Nesbitt · 0 upvotes · 0 comments - [I Built a Tool to Stop Wasting Time on Toxic Open Source Projects](https://daily.dev/posts/i-built-a-tool-to-stop-wasting-time-on-toxic-open-source-projects-oynvruenf) · DEV · 63 upvotes · 5 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#npm](https://daily.dev/tags/npm), [#web-components](https://daily.dev/tags/web-components) [View this post on daily.dev](https://daily.dev/posts/am-i-neglecting-my-open-source-projects-zachleat-com-abpnzherh)