How upgrade verdicts work
Every verdict answers one question: should you install this exact version now, wait, or pick a different one? Verdicts are computed from public evidence, and every reason links to its source. Nothing is editorial and nothing is paid.
Verdicts
- OSV reports malicious code for this exact version, the version was removed from npm, or the maintainer deprecated it for a security reason.
- A newer version on the same line is clearly better: a patch followed much faster than the project's usual cadence, a high or critical advisory (or three or more advisories) is fixed in a newer version, or the maintainer deprecated this version.
- The version is younger than 72 hours. Most regressions surface in that window. Security fixes for high or critical advisories are exempt.
- Needs a human look: a new major (or 0.x minor), a license change, newly added install scripts, lost build provenance, or advisories without a fixed version.
- Older than 72 hours with no negative signals, and every source answered.
- A source did not answer or the version is too new to be listed. We never show “safe” without complete data.
Sources
- OSV.dev — security advisories and malicious-package reports (including the OpenSSF malicious-packages feed).
- deps.dev — the version list, publish times, maintainer deprecations and SPDX licenses.
- npm registry — install scripts, build provenance attestations and deprecation messages.
- npm download counts — weekly downloads per version.
Tracked packages are refreshed every 30 minutes. Other packages are computed when someone asks and cached for up to six hours. We do not run our own malware scanner; malware verdicts come only from OSV.
Limitations
- A fast follow-up patch is a strong hint of a hotfix, not proof. The reason always names the follow-up version so you can check its notes.
- Breaking changes inside a minor release are not detected yet; read the official release notes before merging.
- A verdict is about the version, not your code. Run your tests.
Spotted a wrong verdict? Tell us and include the package and version.