rot-detector
Scores npm and PyPI dependencies for abandonment before they become a supply-chain risk.
- Domain
- Supply-chain security
- Built with
- TypeScript, Node.js, npm API
- Source
- github.com/notsointresting/rot-detector
- npm
- npmjs.com/package/rot-detector
The problem
Vulnerability scanners catch published CVEs but miss abandoned packages nobody is maintaining.
How it works
- Scans package.json and requirements.txt.
- A rot score from 0 to 100: freshness 40%, maintainer count 30%, licence safety 30%.
- Threshold flags that fail a CI build.
Where it landed
Published on npm as rot-detector, with Healthy, Warning and Critical bands and JSON export.
Stack
- TypeScript
- Node.js
- npm API
- PyPI API