I Built PkgWatch to Predict npm Package Abandonment Before It Breaks Your Build

Source: Dev.to

Colors and faker broke thousands of builds overnight in January 2022.
Event‑stream was compromised with crypto‑stealing malware.
The infamous left‑pad incident took down React and Babel.

These weren’t traditional security vulnerabilities. They were maintainer problems, and tools like npm audit couldn’t catch them.

I manage dependencies for several production applications and grew tired of being blindsided by:

• Packages that suddenly stop being maintained
• Single‑maintainer projects where one person holds all the keys
• Subtle signs of abandonment that only become obvious in hindsight

Introducing PkgWatch

PkgWatch is a dependency‑health intelligence platform that predicts these problems before they happen. It analyzes packages across multiple signals and assigns each a health score (0‑100) and a risk level (LOW, MEDIUM, HIGH, CRITICAL).

Signals Analyzed

Health Scoring

Each package receives:

• Health Score: 0‑100
• Risk Level: LOW, MEDIUM, HIGH, CRITICAL

Installation

npm install -g @pkgwatch/cli

Basic Usage

Check a single package

pkgwatch check lodash

Sample output

lodash (npm)
  Health Score: 72/100
  Risk Level: MEDIUM

  Maintainer Health: 65 (1 active maintainer in last 90 days)
  Evolution: 58 (Last release: 8 months ago)
  Security: 85 (OpenSSF: 6.2/10)
  Community: 78 (142 contributors)

Scan all dependencies in package.json

pkgwatch scan

Fail CI on high‑risk packages

pkgwatch scan --fail-on HIGH

GitHub Action example

- uses: Dlaranjo/pkgwatch/action@v1
  with:
    api-key: ${{ secrets.PKGWATCH_API_KEY }}
    fail-on: HIGH

Live Demo & Pricing

• Live Demo – Try it without signing up (20 requests/hour)
• Free Tier – 5,000 requests/month, no credit card required
• Documentation – Full API reference

Roadmap

• Support for additional registries (PyPI already supported; Cargo/Go coming soon)
• Historical trend analysis
• Slack/Discord notifications for health changes

Feedback

I’d love to hear your thoughts! What signals would you like to see tracked?

Links

• Website:
• GitHub:
• npm: