Scarf is like Google Analytics for your npm packages. Gain insights into how your packages are installed and used, and by which companies.
70%
Total Score
63
100
81
50
The package runs a postinstall script, which increases installation-time behavior and maintenance sensitivity for consumers. The provided README documents that it reports installation analytics and offers an opt-out environment variable, improving transparency but not removing the operational concern.
The package has 27 releases since December 2019, but no registry release in the last 12 months and the latest release was in November 2024. This is a meaningful maintenance concern, partly offset by recent repository activity.
All one recent commit came from a single contributor. Because the repository is organization-owned, handoff capacity is better than for an unaffiliated solo project, but recent activity is still highly concentrated.
Only one commit was recorded in the last three months, showing limited recent implementation activity. The recent push and open pull requests provide some compensation, but not enough to make the cadence fully reassuring.
The repository has open issues and pull requests, with two new pull requests in the last month. No issues were closed and no pull requests were merged in that period, so this is only modest evidence of active maintenance.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.