Dormant at the core: Inactivity, dependence and exit among the most downloaded npm packages

Abstract Modern software is assembled from open-source packages maintained largely by volunteers, and a package that stops being maintained can leave thousands of dependent projects without bug or security fixes. We studied the 15,868 packages that receive at least one million weekly downloads on npm, the package registry of the JavaScript ecosystem, using the complete release and dependency history in the public registry up to October 2026. Of these packages, 34.7% had not published a stable release in the preceding 24 months (27.0% to 44.1% for thresholds of 36 and 12 months), and a further 4.6% had been formally deprecated by their maintainers. Dormancy was common at every level of popularity, including 26% of the 100 most downloaded packages. Dormant packages were not peripheral: 26.5% of actively maintained packages depended directly on at least one dormant package, and single dormant packages were reachable through dependency chains from more than a thousand other high-download packages. Only 3.2% of dormant packages stated in their repository README that they were no longer maintained. Two years after a reference date, dependents had removed 27.0% of their dependencies on packages that were dormant at that date, compared with 22.5% of dependencies on active packages (adjusted odds ratio 2.15); removal rose to 65.4% when the dormant package was later deprecated through npm’s deprecation mechanism (odds ratio 6.50), whereas a README notice showed no detectable effect. Fifteen percent of dormant packages were later revived with a new release. Few dormant packages carried known vulnerabilities in their latest version (0.47%, against 0.06% of active packages), but those that did could no longer be fixed upstream. Dormancy is widespread and mostly silent among the most used packages; explicit deprecation through the registry is the signal that dependents act on.