Binance’s $6.34 Billion Hack: Developer Machines, AI Tooling, and Wallet Signing ↗
StepSecurity Blog
Dependency maintenance, made clearer
Spot fading maintenance, licence changes and deprecation in the open-source packages you rely on.
Start with a public manifest. No account needed.Turn a manifest into an explained maintenance review list.
Check your project →Watch selected packages and get alerts when things change.
Build your watchlist →Fits the way you work
Add maintenance context alongside your existing delivery and security tools.
See where isitdeadyet fits →CI, inventory and setup guide →From the catalog
Was dead. request is abandoned by its maintainers' own account — the README says it is no longer maintained, no commits for over 6 years. Plan a migration rather than waiting for a fix.
·Was finished. audit-ci appears abandoned — last commit 22 days ago. 4 of 19 open issues have had no reply. Plan a migration rather than waiting for a fix.
·Was active. @types/enzyme-to-json appears abandoned. No issue data available. Plan a migration rather than waiting for a fix.
·Beyond maintenance
Latest security headlines · automated leads, not confirmed package findings. Last news check: .
StepSecurity Blog
BleepingComputer
The Register Security
Make maintenance a planned decision
The six verdicts
| Verdict | Trigger |
|---|---|
| active | A commit in the last 90 days. |
| coasting | No commits for 90–365 days, with nothing else deteriorating. |
| finished | No commits for over 365 days, and almost nobody filing new issues — or the README says the project is done. |
| drifting | No commits for 180–365 days plus a deterioration signal: unanswered issues rising, maintainers down to one, or issue response time doubling. |
| abandoned | No commits for over 365 days with unanswered issues piling up — or the registry marks it deprecated, or the repository is archived. |
| dead | The repository is archived and the registry marks it deprecated, or the package has been removed from the registry. |
An issue counts as unanswered once it has gone 14 days without a reply. Nothing changes verdict on a single bad day either: a new state has to hold across two crawls at least 7 days apart before we act on it. The exceptions are facts rather than inferences — an archived repository or a registry deprecation counts immediately.