A Billion Downloads a Month, No Release in Four Years

Download counts tell you how many people pull a package. They cannot tell you whether anyone is still home. This page measures the second thing, across the JSON category — where the oldest packages are also some of the largest.

Every metadata cell is the registry's own value for the package's latest dist-tag, read on 2026-10-13 from registry.npmjs.org/<pkg>. Ages are stated against that fixed date and never as "X days ago", because a relative cell is true the day it is written and wrong every day after. Download cells are the published window 2024-10-01 to 2026-10-10 (first 30 days against last 30), pulled 2026-10-12 — same numbers as the libraries page.

The fourteen packages, as the registry has them

json5: 1.082B a month, last released 2022-12-31

The single most startling pair on this site.

json5 is pulled 1.082 billion times in the last 30 days, grew +226% across the window, and its latest release is 2.2.3 from 2022-12-31 — 1,382 days, nearly four years, before the measurement date. Two publish accounts. The number is larger than most of the packages people worry about, and the release predates four Node majors.

safe-stable-stringify is the same shape: 267.8M a month, +310%, one maintainer, last shipped 2024-08-24 (780 days).

Neither of these is evidence of a problem in the code. JSON5 is a fixed syntax and deterministic stringification is a solved algorithm — there is genuinely little left to ship, which is why both have zero dependencies. What the dates do establish is that nothing is coming. If either ever needs a fix, the record says nobody has needed to make one in 780 and 1,382 days, and there is no queue.

ajv-formats is the dependency-coupling case

This one is not about staleness alone, and it is the reason the release date of a dependency can matter more than your own.

ajv-formats grew +487% to 617.6M downloads a month, has 3 maintainers, and last shipped 2024-03-30 — 927 days. It declares 1 dependency: ajv, which shipped 2026-04-24, 755 days later, on a 8.x line. So a package pinned to [email protected] is frozen against an AJV contract that has moved a long way underneath it, and no amount of maintainer attention on ajv-formats changes what the newer AJV does with its format definitions.

The lesson generalises badly and usefully: a fresh dependency does not make your stale dependency fresh. Check the date on the thing you installed, not just the thing at the top of your package.json.

The healthy end of the table

prettier is the outlier on every axis: 11 maintainers, zero runtime dependencies, released 2026-10-10, 615.4M a month. It is the only package here with a publish team rather than a publisher.

lossless-json and jsonrepair are the interesting pair. Both are small, zero-dependency, one-maintainer, and shipped within the last four months; both are growing violently (+743% and +14.9×). They exist because JSON.parse silently changes your numbers, and their growth is that problem being discovered. Small, fresh, single-maintainer is not a red flag — it is the normal shape of a package that solves one recent problem well. It is also exactly the shape where a future fix depends on one person.

Nine of these fourteen have zero runtime dependencies. For code that parses and serialises data at the edge of your system, that is a real property: nothing below it can move without you knowing.

What this does and does not prove

A release date is a fact; what it implies is not.

Old and single-maintainer is not "broken". json5 implements a specification that has not changed. Zero dependencies means the supply-chain surface is genuinely empty, which puts several of these below an actively-released package that drags six dependencies with it.

And npm's maintainer count measures publish access, not effort. It says how many people can ship a release, not how many review issues. A project with 40 committers and one releaser is a 1 on this table, and prettier's 11 may be a bot roster.

What the dates prove is narrower: for json5, safe-stable-stringify, ajv-formats, and jsonschema, a future fix is not something you can wait for — 644 to 1,382 days with nothing shipped. Which makes the decision not "is this library good" but "can I live with forking it in 2028".

Do this

1. Check the release date on the package you installed, not just the top-level one. ajv-formats is the counter-example to trusting a fresh ajv.
2. Prefer zero-dependency packages where they do the job; nine of these fourteen have nothing below them.
3. Treat a 1 as one credential, and a large number as a team that may not exist. Both readings are wrong in opposite directions.
4. Pin exact versions for the stale ones. A floating range on a package nobody releases resolves identically forever — until somebody else publishes on it.
5. For precision, do not rely on a library's age as a proxy for correctness. Read what JSON.parse does to a 19-digit integer and decide from that.

Related: JSON libraries in 2026, the numbers JSON loses silently, JSON Schema validation, JSON alternatives, JSON hacks.

Metadata came from registry.npmjs.org on 2026-10-13 and is re-checked cell-by-cell by scripts/verify-registry-meta.mjs. Download cells are verified by scripts/verify-npm-figures.mjs against the window above. Ages were computed against the fixed date 2026-10-13, not against "today". Prose readings ("stale", "frozen", "healthy") are argument, not measurement, and the verifier deliberately leaves them alone.