Audit of 8,943 dependencies finds 13.4% have no maintainer

A depproof study of 24 public repositories (8,943 components across five ecosystems) found 1,202 components (13.4%) carry a signal of no maintenance. 79.9% of those signals are inferred from four years without a release or repository activity rather than a maintainer's declaration. The rate is flat between production and build/test dependencies.

• 1,202 of 8,943 components (13.4%) carry a no-maintenance signal
• 79.9% of signals are inferred from four years without releases or commits
• npm 15.1%, Go 14.0%, Gradle 11.9%, Maven 5.5%, PyPI 3.1%
• Production 14.0% vs build/test 13.5% — no clustering