Abandoned package in dependencies
Part of the Dependency supply chain check · fix arrives as a guide
What it is
A dependency has had no releases or commits for a long period and appears unmaintained.
Why it matters
When a vulnerability is found there will be no patch, and you inherit the work of forking or replacing under time pressure. Abandoned packages are also the ones most often transferred to a new owner who is not the author you trusted.
How to fix it
Replace it with a maintained alternative, or vendor the portion you actually use so the surface is code you own. If neither is practical, subscribe to advisories for it so you learn about a problem from a feed rather than an incident.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.