bunyan

npm · Rank #202 of 217

64 / 100 D

STALE — No release in 1990 days. Stale packages accumulate unpatched vulnerabilities.

npm publisher

Single point of failure

downloads/week

Blast radius if compromised

14.4y

package age

Established package

1990 days ago

last release

Possibly unmaintained

GitHub contributors

Many contributors, single publisher

— Provenance Not enabled

— Staged Publishing Not enabled

⚠️ Dormant Access 1 inactive publisher with npm access

Risk analysis

bunyan is flagged HIGH risk due to rapid adoption with limited publisher depth. New packages with fast growth are higher-risk targets.

Publisher depth — How many people can push to npm? Single-publisher packages are the #1 structural risk.
Longevity — Older packages have track records. New packages with high adoption are higher risk.
Release consistency — Regular releases signal active oversight. Long gaps mean unpatched vulnerabilities.
Download trend — Growing packages attract more scrutiny (and more attacks).
OpenSSF Scorecard — Process security: branch protection, code review, CI/CD safety.
Build provenance — Published versions linked to specific CI runs via SLSA attestation.
Staged publishing — Human approval gate between npm publish and going live.

You came looking for bunyan. Your node_modules has hundreds more. Run one command to score every dependency you ship:

npx proof-of-commitment

Auto-detects your lockfile. Scores every dependency. Zero install.