pkg-pulse

Check the health of your npm dependencies - maintainers, activity, and abandonment risk.

pkg-pulse vs npm audit

| | npm audit | pkg-pulse | |---|-------------|--------------| | Focus | Security vulnerabilities (CVEs) | Maintenance health | | Question | "Has this package been exploited?" | "Is this package still maintained?" | | Data source | npm advisory database | npm + GitHub API | | Catches | Known security issues | Abandoned packages, bus factor | | Misses | Unmaintained packages | Security vulnerabilities |

Use both. They're complementary.

npm audit     # Security
pkg-pulse     # Maintenance

Example

| Package | npm audit | pkg-pulse | |---------|-------------|--------------| | lodash 4.17.20 | ⚠️ CVE-2021-23337 | ✅ Healthy (active, 3 maintainers) | | abandoned-lib 1.0.0 | ✅ No issues | 🔴 High risk (1 maintainer, no commits in 2y) |

A package can pass npm audit but be abandoned. If a vulnerability is found tomorrow, who will fix it?

Installation

npx pkg-pulse           # Run directly
npm install -g pkg-pulse # Or install globally

Usage

pkg-pulse                    # Analyze current directory
pkg-pulse -p ./my-project    # Analyze specific project
pkg-pulse --verbose          # Show all signals
pkg-pulse --json             # Output JSON (for CI)
pkg-pulse --no-dev           # Exclude devDependencies

Example Output

📦 Package Health Report
   Project: my-app
   Analyzed: 47 packages

   ████████████████████████████████████░░░░

🔴 old-lib 25/100
   1 maintainer · 234 ★ · last commit 2y · 89 issues
   ✗ No npm release in 2y (>2y)
   ✗ No commits in 2y (>18mo)
   ⚠ Single maintainer (bus factor risk)

⚠️  some-pkg 55/100
   2 maintainers · 1.2K ★ · last commit 8mo · 45 issues
   ⚠ No commits in 8mo (>6mo)

✅ express 100/100
   12 maintainers · 65.2K ★ · last commit 1w · 156 issues

✅ lodash 95/100
   3 maintainers · 59.8K ★ · last commit 3mo · 89 issues
   ℹ 3 maintainers (small team)

────────────────────────────────────────────────────────────
Summary:
   ✅ 44 healthy
   ⚠️  2 warnings
   🔴 1 high risk

GitHub Token (Recommended)

Without a token: 60 requests/hour. With a token: 5000 requests/hour.

# Create at: github.com/settings/tokens (no permissions needed)
export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
pkg-pulse

Scoring

| Signal | Impact | |--------|--------| | Deprecated / Archived | -100 (instant high risk) | | No maintainers | -40 | | 1 maintainer | -15 | | 2-3 maintainers | -5 | | No release >2y | -30 | | No release >1y | -20 | | No commits >18mo | -25 | | No commits >1y | -15 | | >500 open issues | -15 | | <50 stars | -5 | | >10K stars | +10 |

Risk levels: 🟢 >= 70 | 🟡 40-69 | 🔴 < 40

CI Integration

- name: Check dependencies
  run: npx pkg-pulse --json > report.json

Exit codes: 0 = healthy | 1 = high risk found | 2 = error

Limitations

• npm only (no Maven, pip, etc.)
• GitHub only (GitLab/Bitbucket = limited data)
• Use a GitHub token for large projects

License

MIT