Last reading2026-09-02 04:32 UTCage unavailable without scripting
What the readings actually say.
Every other page here is a table, which is the right shape for a reading and the wrong shape
for a claim. These are the things worth saying out loud — each with the sample it rests on and
a link to the numbers behind it.
Every sentence on this page is assembled from the published data with its figures filled in.
None of it is written by hand or by a model, so none of it can drift from what was measured.
A finding whose numbers fall below the bar it needs stops appearing.
98 of 416 widely used projects rest half their history on one person
Counting from the most prolific contributor down, one person accounts for half of all commits. The most concentrated is ethers-io/ethers.js, where the largest single contributor wrote 100% of 826 commits.
What it rests on. Contributor histories of 416 repositories, read weekly from GitHub. Commit count is not contribution, and this is history rather than the present.
Why it is not published elsewhere. Every health signal in circulation measures activity. None measures who is producing it.
11 of 182 tracked packages have not shipped a release in over a year
Read from the registries rather than from a repository’s last push — a push is what a maintainer does for themselves, a release is what reaches the projects depending on them. The longest silence is bellman on crates, 1,262 days.
What it rests on. 182 packages across npm, PyPI and crates.io, read daily. Median time since release across all of them is 26 days.
Why it is not published elsewhere. Every "is this maintained" badge reads the wrong field.
123 package names one keystroke from something you install already exist on npm
Generated by deleting or transposing one character in a real package name, then asked of the registry directly. bootstrap alone has 15: boostrap, boosttrap, bootsrap, bootsrtap.
What it rests on. 31 of the most installed packages swept. Deletions and transpositions only, so this finds fewer than exist. Existence is the entire claim — none of these is called malicious.
Why it is not published elsewhere. npm’s own search ranks by popularity, which is exactly the ordering that hides these.
A pypi package carries 59.0× the advisory load of a nuget one
Among packages with at least one advisory on record, pypi averages 59 and nuget averages 1.
What it rests on. 4,224 all-time advisories across hand-picked prominent projects, from OSV. Counts are all-time, so age and scrutiny raise them as readily as danger, and the registries differ in size and age.
Why it is not published elsewhere. Advisory counts are published per package. Nobody totals them per ecosystem.
Their own status page, kept after it stopped carrying them. Atlassian announced none in the same window. A count measures how often a provider publishes, so one that discloses every degradation out-counts one that stays quiet.
What it rests on. 850 incidents across 22 providers, 730 days on record here. Never read a low number as a good one.
Why it is not published elsewhere. Every status page forgets after a few months. This one does not.
Counted across one month of Hacker News job posts. The largest move against last month is PostgreSQL, up 4.0 points.
What it rests on. 386 posts in 2026-08, compared against 427 the month before. One forum, skewed hard toward American startups — evidence about that population and no wider one.
Why it is not published elsewhere. Every other signal here measures what developers publish. This measures what somebody paid to ask for.
24 tracked release lines stop getting security fixes within a year
The soonest is oracle-jdk 26, which ends on 2026-09-18 — 16 days away.
What it rests on. 24 runtimes, databases and frameworks, read daily from endoflife.date. Dates are theirs and republished unchanged; nothing here is inferred.
Why it is not published elsewhere. The dates are announced years ahead and watched by almost nobody.