StackRot

Dependabot tells you about CVEs. StackRot tells you the package has one maintainer who stopped committing eight months ago.

Dependencies don't only fail by getting hacked. They get abandoned. They change licenses from MIT to BSL. They end up maintained by one person who moved on. None of this triggers a vulnerability alert, and you find out when you need an urgent fix and nobody is home.

StackRot surfaces the silent rot signals nothing else catches.

⚡ Instant CLI Check

Run an instant health audit on your current directory's manifest or lockfile without installing anything:

npx stackrot check

Supports:

• NPM / Node: package.json, package-lock.json, pnpm-lock.yaml, yarn.lock
• PyPI / Python: requirements.txt, poetry.lock
• Crates / Rust: Cargo.toml, Cargo.lock

🔍 The Signals Dependabot Ignores

| Signal | What StackRot Surfaces | Why It Matters | |---|---|---| | Maintainer Inactivity | No commits to package in 6–12+ months | The library is abandoned before an upstream bug hits you | | Bus Factor = 1 | Only 1 contributor committed in the past year | Single human point of failure for critical dependencies | | License Drift | Permissive (MIT/Apache) → Restrictive (BSL/SSPL) | Avoid surprise compliance or commercial license violations | | Deprecation & Archival | Registry deprecation flag & GitHub archived status | Upstream maintainer has officially dropped support |

🌐 Web Dashboard & Continuous Weekly Monitoring

For continuous repo monitoring and weekly digests, visit stackrot.poorvithmp.com:

• Calm Monitoring: Zero external API calls in dashboard paths. Fast, cached queries.
• Zero-Spam Weekly Email Digest: We only send a weekly digest if new signals are detected. Never a "nothing changed" email.
• Read-Only GitHub Scope: We never ask for repo write access or store your source code.

🛠 Local Development

git clone https://github.com/prvthmpcypher/stackrot.git
cd stackrot
pnpm install
pnpm test
pnpm run dev

📄 License

MIT © Poorvith M P