Any tool out there to determine a Github repo's "reputation" / "stale-ness"?
Whenever I start a new project that I think will turn into something more than just a little experiment on the side, I like to do a little bit of research on any packages that I might install from npm (or whatever package manager I might be using at the time) to see if packages are still actively being maintained and how the community feels about them.
I usually go about this by doing a quick glance at how often an npm package is being installed, looking at commit frequency, how quickly / often do maintainers respond to comments, etc. I also sometimes end up doing this for multiple packages that do similar things to compare my options.
I'm first wondering if I'm silly, there is already something out there, and I can't google to save my life? But if not, do you think folks would find something like that useful?
Thanks!
Ruby toolbox sort of does this: they have various labels and statistics that they apply to projects to indicate how well they're maintained. For example see here: https://www.ruby-toolbox.com/categories/http_clients
This would definitely be useful from a security perspective, especially if it also analyzes how quickly issues are responded to. Especially if those issues have words like "vulnerability" or "security" in them.
Sadly I have to agree that it's a bit problematic from a commercial perspective. I'm responsible for vetting new dependencies for one of my clients, and this wouldn't save me enough time to get a subscription. Especially because I can only use it to weed out the most unmaintained candidates. I would still have to check by hand to be completely sure before approving.
Supply chain vulnerabilities are definitely a hot topic though. Releasing this for free may or may not be useful for building an audience.
I'm not aware of any direct competition, and the idea does sound useful, but not great commercially.
It's a low frequency and a low intensity problem: without your product I'd just need to check manually for a minute or two, once or twice a month. That's not enough reason to buy subscription, and with the short infrequent usage your ad revenue would not be great either.
While I agree for personal reasons or a small company I wouldn't buy it,
I wonder if a security spin on it might be interesting for bigger companies..
There are security scanners for the packages used... I wonder if any has or would use the concept of unmaintained as a security warning...
Good point with the larger companies as customers, but then if this becomes popular, the established security scanner products can clone this in a week, and kill the OPs business..