Abandoned Dependency Risk Monitor — Bus Factor, Not CVEs
Flags npm packages at risk of going unmaintained before anything is reported against them: single maintainer, gone quiet. The xz-utils and event-stream incidents both had this exact shape before anyone found a CVE. Sibling to the Dependency Vulnerability Advisor, which checks known CVEs instead.
Abandoned Dependency Risk Monitor — Bus Factor, Not CVEs returns 16 documented output fields, including package, status, risk, verdict and maintainerCount. Every field carries a declared type, a written description and an example value. 24 runs are recorded on Apify.
- 16
- Output fields
- 2
- Inputs
- 24
- Runs
- 2026-10-16
- Last run
01 — output
What it returns
Every field the extractor writes to its dataset, with its type, a written description and an example value.
| Field | Type | What it holds | Example |
|---|---|---|---|
| package | stringnull | Package name. | lodash |
| status | stringnull | Outcome recorded for this row. | ok |
| risk | stringnull | Risk assessment for this row. | low |
| verdict | stringnull | The Actor's conclusion for this row, stated in words. | pass |
| maintainerCount | integernull | How many maintainers the project lists. | 0 |
| maintainerNames | stringnull | Names of the people maintaining this project. | <maintainerNames> |
| monthsSinceLastPublish | numbernull | Months since the last release or publication. | 0 |
| lastPublish | stringnull | Date of the most recent publication. | <lastPublish> |
| latestVersion | stringnull | Most recent version published upstream. | 4.2.1 |
| versionCount | integernull | How many versions are published. | 0 |
| isDeprecated | booleannull | Whether the source marks this as deprecated. | true |
| deprecatedMessage | stringnull | The deprecation notice, as the source publishes it. | <deprecatedMessage> |
| hasRepository | booleannull | Whether a source repository was found. | true |
| license | stringnull | Licence or registration the record holds. | MIT |
| monthlyDownloads | integernull | Downloads in the last month. | 0 |
| popularity | stringnull | Popularity measure as the source publishes it. | 74 |
02 — sample
One record
Assembled from the example values declared on the schema above, not invented at render time.
{
"package": "lodash",
"status": "ok",
"risk": "low",
"verdict": "pass",
"maintainerCount": 0,
"maintainerNames": "<maintainerNames>",
"monthsSinceLastPublish": 0,
"lastPublish": "<lastPublish>"
}03 — input
What you give it
| Input | Type | Description |
|---|---|---|
| packages | arrayoptional | npm package names from your dependency list, e.g. left-pad, event-stream. Usually production dependencies, not devDependencies. |
| concurrency | integeroptional | How many packages to check in parallel. |
04 — run
Run Abandoned Dependency Risk Monitor on your own input
It runs in the cloud on Apify. Nothing to install, and you are billed per result returned rather than per attempt.
05 — questions
Asked before running it
16 of 16 fields described
- What does Abandoned Dependency Risk Monitor — Bus Factor, Not CVEs return?
- It returns 16 documented output fields: package, status, risk, verdict, maintainerCount, maintainerNames, monthsSinceLastPublish, lastPublish, latestVersion, versionCount, isDeprecated and deprecatedMessage. Each field declares its type, a description of what it holds, and an example value. The remaining 4 are listed in the output schema below.
- What input does Abandoned Dependency Risk Monitor — Bus Factor, Not CVEs take?
- All 2 inputs are optional and ship with usable defaults, so it runs as-is. They are listed with their types below.
- Does Abandoned Dependency Risk Monitor — Bus Factor, Not CVEs need an API key or login?
- No. None of its inputs is a credential, and it reads only public data. Nothing to sign up for before the first run.
- How do I run Abandoned Dependency Risk Monitor — Bus Factor, Not CVEs?
- It runs on Apify. Start it from its listing with the inputs above, or call the Apify API with the Actor's ID. Results land in a dataset you can export as JSON, CSV or Excel, or read through the Apify API into your own pipeline.