synckitnpm

Verdict

Quiet, but healthy

synckit has been quiet — no commits for 3 months, but nothing suggests trouble: 3 of 4 open issues have had no reply. This is a settled project, not a stalled one.

health 75/100

Why this verdict?

coasting — No commits for 90–365 days, with nothing else deteriorating.

last commit 95 days ago

Judged yesterday from signal heuristics. How each verdict is decided

latest 0.11.13
licence MIT
stars 271
checked yesterday
registry ↗
repository ↗

Signals · last 1 check

Commits 90d

Open issues

Unanswered

Contributors

State history 1

When	Change
2026-09-03	first verdict: coasting

Supply-chain history 1

account hijacked 2025-07 0.11.9

The maintainer was phished through the look-alike domain npnjs.com and the stolen token published versions whose install script loaded a Windows trojan.

Tokens revoked and the versions deprecated and removed within hours; CVE-2025-54313.

Source: Socket and Snyk analyses, 19–22 July 2025. History, not a warning about today — the verdict above is about maintenance now.

Badge

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/synckit.svg)](https://isitdeadyet.dev/npm/synckit)

Watch it

Get told when synckit changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.