npm package health lite

该 Skill 通过一次匿名 npm 注册表请求获取指定包的最新版本、最后发布时间、距今天数、弃用标记和许可证，并按发布时效或弃用启发式输出健康状态与安装建议；不安装包，也不执行包代码。

nenadzivotic

热度 16.00

最近更新 2026-10-17 23:29:36

分类：开发依赖：代码执行 / 第三方 API应用场景：研究 / 推荐

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add nenadzivotic/npm-package-health-lite

Metadata

name: npm-package-health-lite
description: Quick health check on an npm package before installing — latest version, days since last publish, deprecation flag, license, and a stale/deprecated heuristic. One unauthenticated registry request. Use when the user asks if an npm package is maintained or safe to add.

npm Package Health (Lite)

Network access (declared)

One GET to registry.npmjs.org/<package> — public registry metadata. No other hosts, nothing sent, no package installed, no code executed.

Boundaries

"Stale" is a heuristic on publish recency — quiet packages aren't necessarily abandoned.
No weekly-download stats in this lite version (that is the full version's second API call).

1. Run

Requires Node 18+, zero dependencies.

node <skill-dir>/scripts/health.mjs <package-name>

JSON on stdout; exit 1 on fetch failure, 2 on missing argument.

2. Read the report

latest, lastPublish, ageDays, deprecated, license, health.
Flag: deprecated string present, ageDays > 730, license: null.

3. Report

<package>@<latest>: <health>
last publish Y days ago · license <spdx|none> · deprecated <yes/no>
<one-line recommendation: safe to add / pin version / consider alternative>

Lite vs full

The full npm-package-health additionally reports weekly downloads (api.npmjs.org), maintainer count, and dependency count.