napi-postinstallnpm

Verdict

Quiet, but healthy

napi-postinstall has been quiet — no commits for 11 months, but nothing suggests trouble: 1 of 7 open issues have had no reply. This is a settled project, not a stalled one.

health 74/100

Why this verdict?

coasting — No commits for 90–365 days, with nothing else deteriorating.

last commit 335 days ago

Judged yesterday from signal heuristics. How each verdict is decided

latest 0.3.4
licence MIT
stars 6
checked yesterday
registry ↗
repository ↗

Signals · last 1 check

Commits 90d

Open issues

Unanswered

Contributors

State history 1

When	Change
2026-09-03	first verdict: coasting

Supply-chain history 1

account hijacked 2025-07 0.3.1

The maintainer was phished through the look-alike domain npnjs.com and the stolen token published versions whose install script loaded a Windows trojan.

Tokens revoked and the versions deprecated and removed within hours; CVE-2025-54313.

Source: Socket and Snyk analyses, 19–22 July 2025. History, not a warning about today — the verdict above is about maintenance now.

Badge

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/napi-postinstall.svg)](https://isitdeadyet.dev/npm/napi-postinstall)

Watch it

Get told when napi-postinstall changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.