No packages with fewer than 50 weekly downloads

A production dependency with under 50 weekly downloads has almost no community scrutiny — no one is filing issues, no one is reviewing commits, and no one is running automated CVE scans against it. This makes it an ideal target for a supply chain takeover: an attacker can register a nearly identical package name or, if the package is already published, request maintainer access from an unresponsive original author. OWASP A06 covers the risk of components without active community oversight. CWE-1357 applies when the trustworthiness of a component cannot be independently verified. Low download counts also serve as a signal for typosquatting — the intended package likely has orders of magnitude more downloads than the misspelled one you may have accidentally installed.

For each low-download production dependency, run a quick provenance check:

npm info package-name

Compare the author, publish history, and download count against the package you intended to use. If the package is a genuine niche utility with no better alternative, consider vendoring it into src/lib/ to eliminate the external dependency entirely:

# Copy the source, remove the registry dependency
npm uninstall low-download-package
# paste the source into src/lib/package-name.ts