Solo maintainers of critical npm packages have a 36% annual probability of abandoning projects depended on by millions

Of the 28 million npm package releases, 16 million are maintained by a single person, and 60% of these solo maintainers are unpaid volunteers. Critical dependencies have a 36% chance of losing their only contributor in any given year, meaning the entire JavaScript ecosystem rests on individuals who could walk away at any time. Why it matters: solo maintainers burn out and stop responding to issues, so critical security patches go unshipped for months, so downstream applications inherit unpatched vulnerabilities, so enterprises running production systems on these dependencies face breach risk, so end users' personal data and financial information become exposed at scale. The structural root cause is that package managers like npm have no mechanism to flag or intervene when a widely-depended-upon package has a bus factor of one, and neither corporations consuming these packages nor the npm registry itself provide systematic financial support or succession planning for solo maintainers.