Attribution

Almost nothing here is our data. Libyears reads public registries and advisory databases, joins them to your lockfiles, and does arithmetic. The value is in the joining and the judgement; the facts belong to the people below.

Data sources

The last column is the one that matters if you are reviewing this for a client. A private package name is never sent to any of them.

npm registryPublic data; npm terms permit replication

Published versions, release dates, dist-tags, deprecation, and versions removed from the registryWhat we send: Public package names only

OSV.devPer-source; the aggregation is open

Vulnerability and malware advisories across every contributing databaseWhat we send: Public package names and versions, batched

GitHub Advisory DatabaseCC-BY-4.0

GHSA records and the human review that distinguishes a curated advisory from an automated reportWhat we send: Nothing

OpenSSF malicious-packagesApache-2.0

MAL records and the reporting-source list our corroboration rule depends onWhat we send: Nothing

CISA KEVPublic domain

Whether a vulnerability is known to be exploited in the wildWhat we send: Nothing

FIRST EPSSFree to use with attribution

Exploit probability, which separates a high CVSS score from an urgent oneWhat we send: Nothing

endoflife.dateMIT

Runtime and framework end-of-life datesWhat we send: Nothing

Ideas and formats

libyearMIT

Jared Beck’s measure, which is the unit this whole product is denominated in

Cox et al., "Measuring Dependency Freshness in Software Systems" (ICSE 2015)Academic work, cited not copied

The empirical basis for the star thresholds and for treating freshness as a system property

CycloneDXApache-2.0

The SBOM format our export writes

Package URL (purl)MIT

How components are identified in that export

What we give back

The lockfile parsers, the freshness metrics, the npm registry client and the CLI are MIT-licensed and published as @libyears/parsers, @libyears/metrics, @libyears/registry and @libyears/cli. They are the parts most likely to break on a new lockfile format, and the parts that benefit most from someone else’s bug report.

npx @libyears/cli prints the same numbers this product does, offline, with no account. If that is all you need, it is all you need.

Your own inventory

Every repository can be exported as CSV or as a CycloneDX 1.6 document, including the freshness figures as vendor properties. Nothing here is a format you have to stay for; see the security page for how to take it and go.