No dependencies with no maintainer activity in 2+ years

Abandoned packages are a latent supply chain risk: they accumulate unpatched CVEs indefinitely, and their maintainers cannot respond to security disclosures. When an abandoned package becomes popular enough to be a valuable attack surface, malicious actors have successfully requested and received maintainer access — precisely to insert backdoors into what appears to be a legitimate, versioned dependency. OWASP A06 (Vulnerable and Outdated Components) explicitly covers this scenario. CWE-1104 (Use of Unmaintained Third Party Components) names the defect class. SSDF PW.4 requires ongoing vulnerability tracking; you cannot track vulnerabilities in a package whose maintainer has gone dark. The longer an abandoned package stays in your dependency graph, the more likely it becomes that you'll be the last project to find out it was compromised.

For each abandoned dependency, evaluate alternatives before your next deploy cycle:

1. Search npm and GitHub for a well-maintained fork or successor package.
2. If the package is small and stable, vendor it — copy the source into src/lib/ and own it directly.
3. If no alternative exists, open an issue on the repository to determine whether the maintainer intends to continue it.

Add a scheduled npm outdated review to your quarterly engineering housekeeping to catch abandonment before it becomes a crisis.