The State of Package Health

Pillow alone accounts for 106 million weekly downloads. It ships with 3 unpatched vulnerabilities in our index. path-is-absolute has a health score of 20 out of 100, is officially deprecated, and is downloaded 76 million times per week.

Those two facts are not outliers. They are representative. We've spent the last several months indexing 14,812 packages across 17 ecosystems — npm, PyPI, Cargo, Go, Maven, NuGet, RubyGems, Composer, Pub, Hex, Swift, CocoaPods, CPAN, Hackage, CRAN, Conda, Homebrew — and running the same health pipeline against each one. This is a report on what the data actually says. Not marketing.

Methodology

For every package in the index we fetch, on a rolling schedule:

• Registry metadata — versions, maintainers, license, publish dates, deprecation flags.
• Weekly/monthly downloads — from the native registry where exposed.
• Vulnerabilities — from OSV.dev, mapped to affected version ranges.
• Repository stats — GitHub stars, open issues, last commit, bus-factor proxy.
• Breaking changes — curated migration notes between major versions.

A health_score (0–100) is computed from maintenance cadence, vulnerability count/severity, deprecation status, license clarity, and repository vitality. Scores below 40 are critical, 40–59 poor, 60–79 fair, 80+ good. No secret sauce.

The Numbers

Across the 14,812 packages currently tracked:

More than half the packages we index score below 60. These are not obscure libraries. The crawler prioritises popularity — to be in this index a package generally had to clear a download threshold or appear as a dependency of a popular one.

We also track 400 vulnerabilities against 72 packages with more than 1,000,000 weekly downloads. Severity breakdown: 221 medium, 179 unknown / unclassified by source. (We conservatively surface OSV records even when severity is not filled in upstream. Absence of severity is not absence of exploitability.)

Popular but Vulnerable

All of these packages ship more than 100k downloads per week and have at least one open advisory in our index:

A few of these are well-known (next, Pillow, pip). A few are quietly dangerous: rust-crypto has been unmaintained for years, pycrypto is effectively abandoned in favor of pycryptodome, and oauth2-server — which, yes, handles your auth flow — has open advisories and minimal upstream activity.

Zombie Packages

Packages that registries have officially marked deprecated but that continue to ship tens to hundreds of millions of weekly downloads:

Fifty packages in our index are deprecated and still pull more than 1M weekly downloads. Summed, that's roughly 740 million weekly downloads of code that the authors themselves say you should stop using. Most of this traffic is transitive — a dependency of a dependency of a dependency — which is exactly why package intelligence needs to be programmatic. No one is auditing camel-case by hand in 2026.

Worst-Scoring Popular Packages

Filtering by weekly downloads > 500,000 and sorting by health_score ascending:

Note angular at 8/100with half a million weekly downloads — that's AngularJS 1.x, EOL since 2022, still installed somewhere new every few seconds.

Breaking Changes in the Wild

Seventy-nine curated breaking changes are tracked across popular packages. A sample of what's actively biting upgrade PRs this quarter:

• pydantic v1 → v2 — core rewritten in Rust, up to 100x faster, but @validator becomes @field_validator (must be classmethod). class Config replaced by model_config: ConfigDict.
• numpy 1 → 2 — cleaned namespace, many aliases removed, tightened mixed-type promotion rules (NEP 50).
• pandas 1 → 2 — PyArrow-backed dtypes, copy-on-write opt-in (default in 3.0), nullable dtypes default.
• react 18 → 19 — ref is now a regular prop; forwardRef no longer required for most function components. String refs removed. useFormState renamed to useActionState.
• eslint 8 → 9 — flat config (eslint.config.js) is the default; legacy .eslintrc.* no longer read. Many formatting rules removed. Node 18.18+ required.
• typescript 4.9 → 5.0 — Node 12.20+ required, stage-3 decorators replace experimental ones.
• tokio 0.2 → 1 — stable API, feature flags reorganized.

These are the ones agents get wrong. An LLM trained before 2023 will happily write you a @validator on a Pydantic 2 model and waste half an hour of your day.

Ecosystem Comparison

Average health_score by ecosystem, for packages where a score was computed:

Two things jump out:

1. Composer (PHP) leads.Surprising to anyone who hasn't touched PHP since 2012 — the modern Composer ecosystem is small, curated, and actively maintained.
2. Maven trails significantly.The Java ecosystem has a long tail of ancient artifacts still pulled transitively by enterprise stacks. Many score poorly not because they're buggy but because "maintained" means a commit in 2017.

npm, despite dominating in absolute vulnerability count, is not the worst on a per-package basis. It's just the biggest — any per-package pathology is magnified by sheer volume.

What This Means for AI Agents

If an AI coding agent suggests lodash.get in new code, or imports pycryptobecause that's what its 2022 training data remembers, the resulting code review burden falls on you. The agent doesn't know path-is-absolutewas deprecated. It doesn't know pandas 2 shipped copy-on-write. It doesn't know next has 5 open advisories today.

This is the gap DepScope is built to close. Every package recommendation an agent makes should be checked against live data: current version, current health, current vulnerabilities, current deprecation status. Not once. Every call.

Try It Yourself

All of the data above is queryable without auth:

# Health snapshot for a package
curl -s https://depscope.dev/api/check/npm/next | jq '.health_score, .vulnerabilities | length'

# Is it deprecated?
curl -s https://depscope.dev/api/check/npm/path-is-absolute | jq '.deprecated, .deprecated_message'

# Compare alternatives
curl -s https://depscope.dev/api/compare/pypi/pycrypto,pycryptodome | jq '.recommendation'

# Recent breaking changes for a package
curl -s https://depscope.dev/api/breaking/pypi/pydantic | jq '.changes[]'

MCP tools are available for Claude Code and Cursor — the agent gets the data without you having to paste it in. See /integrate.

Next Report

This report is generated weekly from live database snapshots. Numbers will shift as the index grows and vulnerabilities are published. Report #002 lands next Monday.

If you want the raw data behind any figure above, every number in this article is a single query away in the public API.