Free tools Windows power users keep installed
One-click scans. No signup required.
In a 2026 scan of 433 highly starred JavaScript and TypeScript repositories, most dependencies trace back to a small set of npm publishing accounts. One account, sindresorhus, appears in 430 of the 433 projects. The same scan also found that nearly every project pulls in at least one deprecated or archived package. Both findings describe who can publish and what status a package carries. Neither shows that a package is broken, unsafe, or actively maintained by a particular person.
What was scanned
The author began with the 600 most-starred JavaScript and TypeScript repositories on GitHub and kept the 433 that have a lockfile at the repository root: package-lock.json, pnpm-lock.yaml, yarn.lock, or npm-shrinkwrap.json. The lockfile is what makes this kind of analysis possible, because it records every package a project resolves, including transitive dependencies. Those resolved packages came to 27,184 unique npm packages, looked up through the npm registry and the ecosyste.ms data service.
As an Amazon Associate I earn from qualifying purchases.
This is a sample of popular projects that commit a root lockfile. It is not a census of JavaScript, and it says nothing about open source in general. Projects that skip lockfiles, live in monorepos with lockfiles elsewhere, or are not on GitHub are outside it. The figures below come from the author’s write-up, published on DEV Community in 2026. The write-up does not give a more precise scan date, so treat the numbers as a snapshot from that period.
Recommended Free Tools
What the numbers show
The headline numbers are straightforward counts from registry and repository data. The table keeps each one attached to its scope.
#1 Best Overall
| Measure | Reported value | Scope and qualification |
|---|---|---|
| Repositories meeting the root-lockfile rule | 433 of 600 | Top-starred JS/TS repositories on GitHub at scan time |
| Unique npm packages resolved | 27,184 | Across all 433 repositories, deduplicated |
| Packages installed per project (median) | 945 | Median project in the sample |
| Packages with exactly one publishing account (median project) | About half | Excludes organization-owned packages and @types packages |
| Packages published by sindresorhus alone | 513 | At least one appeared in 430 of 433 repositories |
| Repositories with at least one deprecated or archived dependency | 98% | Deprecated and archived are treated together as “dead” in the write-up |
| Repositories containing both path-is-absolute and inflight | About 305 of 433 | Presence in the lockfile, as counted by the scan |
| Packages with a funding link | 24% | Funding field read from npm registry metadata |
Who appears across the most projects
Counting publishing accounts across the whole sample gives a different picture from counting packages. The five accounts with the widest reach are below. Each percentage is the share of the 433 repositories that include at least one package the account can publish.
| Rank | Publishing account | Repositories touched |
|---|---|---|
| 1 | sindresorhus | 430 of 433 (about 99%) |
| 2 | isaacs | 98% |
| 3 | juliangruber | 95% |
| 4 | ljharb | 94% |
| 5 | kevva | 93% |
The write-up notes that these five accounts together touch every repository in the sample. That is a statement about overlap in publishing access. It is not a measure of how much time anyone spends on those packages.
Publishing access is not the same as maintenance
The scan measures who holds the right to publish a new version of a package on npm. It does not identify who is doing the work behind that package. A single account can represent a team that shares credentials or a company’s release process. Several accounts can also belong to one person who has since moved on, or to a person plus former collaborators whose accounts were never retired. The write-up makes this point directly: “A publish account is not an active maintainer.”
Rank #2
The practical question the author raises is this: for each dependency, if the account that can publish stops, is compromised, or simply leaves, what happens to your next build? That question is worth asking of any package with a single publishing account. The scan answers only the first half of it, by showing where publishing access sits.
The nopersonsmodules example
The author also points to an npm account named nopersonsmodules, described as holding 59 packages that were transferred to it when their original authors left the registry. No one publishes from that account. The write-up presents this as an illustration of how publishing rights can outlast the people who created a package. It is the author’s description, not an independent audit of the registry, so treat it as a case to check rather than a verified count.
Deprecated and archived does not mean broken
The scan treats a package as “dead” when it is either deprecated on npm or archived in its source repository. The author’s own wording is that “dormant” does not mean broken. A deprecated package can still install and run, and an archived repository can contain code that works. What the status tells you is that the maintainer has stopped recommending the package or stopped accepting changes to it.
That distinction matters for the 98% figure. A project flagged for a deprecated or archived dependency needs a review, not an automatic rewrite. The review should ask whether the package is still needed, whether a maintained replacement exists, and whether the project has any known vulnerabilities in the version it uses. The scan answers none of those questions on its own.
Running the tool on your own project
The author’s tool is published as npx @genamed/busfactor. According to the write-up and the project README, it has these characteristics:
- It requires Node.js 20.
- It has zero runtime dependencies.
- A run takes a minute or two on a typical project.
- Results are cached. The write-up says a week and the README says seven days.
- Output can be Markdown or SVG.
- A CI option can fail the build when it finds dead dependencies. Check the README for the exact flag, since the write-up does not name it.
The README’s support table varies by lockfile format. npm package-lock.json files in lockfile version 2 or 3 get full analysis. Some other lockfile formats get basic analysis, and others get only suggestions for successor package names. If your project uses pnpm or Yarn, check which level of analysis applies before reading the output as complete.
Rank #4
Data comes from packages.ecosyste.ms together with npm registry fields for deprecation and funding. The README presents this as how the tool is built, not as a guarantee that every source is live or complete at the time you run it. Because results are cached, a package whose status changed recently may still show the older value until the cache expires.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the scan does not check
The README is explicit that the tool does not perform:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- vulnerability scanning
- license checks
- repository health scoring
- malware analysis
- typosquatting analysis
- package size or performance analysis
For vulnerabilities, the README suggests OSV-Scanner as a separate step. Run it alongside this tool, not instead of it. A publisher-concentration report and a vulnerability report answer different questions, and neither one gives you a complete picture of dependency risk.
How to compare projects fairly
If you want to compare your project with another, or with the sample, use three measures and keep each one’s scope visible:
- Single-account packages. The share or count of packages with exactly one publishing account, excluding organization-owned packages and
@typesas the author did. - Publisher reach. How many of your repositories or packages depend on the same publishing accounts.
- Deprecated or archived prevalence. How many packages carry either status, reported separately from whether they are broken or vulnerable.
State the sample, the date, and the data source with every comparison. Do not combine these into a single “bus factor” or risk score. The author’s scan does not provide a method for that calculation, and a combined number would hide the differences that matter most.
How to read these results
The scan is a useful map of where publishing access and deprecated packages sit in a set of popular JavaScript projects. It shows that concentration is common, that one account reaches almost every project in the sample, and that deprecated or archived packages are widespread. It does not show that any individual package is broken, that any maintainer is inactive, or that any project is vulnerable. Use it to decide which dependencies deserve a closer look, then apply a vulnerability scanner and a manual review to the ones you keep.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Raw results and scripts are said to be in the project repository’s study/ directory. The README does not independently recount the article’s statistics, so the figures here are the author’s, not independently verified.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
