v0.1.0 — Initial release

First public release of graveyard-check — a CLI that scans your npm lockfile, flags
dependencies that are effectively abandoned, and recommends verified community-
maintained successors.

What it does

• graveyard-check scan — scans your package-lock.json, flags likely-abandoned or
  at-risk dependencies with evidence (last release/commit age, npm deprecation flag,
  issue response rate), and suggests a maintained successor where one exists
• graveyard-check check <package> — single-package lookup, no lockfile required
• --json output and a GitHub Action wrapper for CI integration

Seed dataset

Ships with 9 researched successor records covering well-known npm abandonment cases:
request, node-sass, moment, request-promise, istanbul, gulp-util, colors, faker,
and tslint. Every record is backed by verified evidence, not guesses — see
data/successors/SCHEMA.md.

Notable finding from building this dataset: npm install faker still installs
6.6.6 — the January 2022 sabotage stub — four and a half years later.

Contributing

The dataset grows through community PRs. See CONTRIBUTING.md for how to submit
a successor record — the bar for evidence is high on purpose, since this data is
the whole point of the tool.

Install

npx graveyard-check scan

What's not here yet

• npm/pnpm/yarn lockfile support only covers package-lock.json for now —
  pnpm-lock.yaml and yarn.lock are planned
• Single ecosystem (npm) — PyPI/Go/crates are on the roadmap
• Fork-health analysis (auto-ranking forks of a dead repo) is not yet automated