Understanding the Response to Open-Source Dependency Abandonment in the npm Ecosystem

kaestner@cs.cmu.edu (C. Miller, M. Jahanshahi, A. Mockus, B. Vasilescu, C. Kästner)
Thu, 11 Dec 2025 09:54:38 GMT

Courtney Miller, Mahmoud Jahanshahi, Audris Mockus, Bogdan Vasilescu, and Christian Kästner. Understanding the Response to Open-Source Dependency Abandonment in the npm Ecosystem. In Proceedings of the 47th International Conference on Software Engineering (ICSE), pages 2355--2367, April 2025. Distinguished Paper Award.

Many developers relying on open-source digital infrastructure expect continuous maintenance, but even the most critical packages can become unmaintained. Despite this, there is little understanding of the prevalence of abandonment of widely-used packages, of subsequent exposure, and of reactions to abandonment in practice, or the factors that influence them. We perform a large-scale quantitative analysis of all widely-used npm packages and find that abandonment is common among them, that abandonment exposes many projects which often do not respond, that responses correlate with other dependency management practices, and that removal is significantly faster when a projects end-of-life status is explicitly stated. We end with recommendations to both researchers and practitioners who are facing dependency abandonment or are sunsetting projects, such as opportunities for low-effort transparency mechanisms to help exposed projects make better, more informed decisions.