Security-focused maintainers of abandoned npm packages.

We fork unmaintained Node.js packages, ship security patches, and keep the ecosystem safe — without introducing new features or breaking changes.

Package	Replaces	npm
pkg-nec/http-server	http-party/http-server (unmaintained since 2022)
pkg-nec/babel-plugin-istanbul	istanbuljs/babel-plugin-istanbul

Switching is a one-line change. No code changes required.

# Remove the unmaintained package
npm uninstall http-server

# Install the maintained fork
npm install @pkg-nec/http-server

# Or run on-demand with no install
npx @pkg-nec/http-server [path] [options]

The binary name (http-server) stays the same.

Switching is a one-line dependency and configuration change.

# Remove the unmaintained package
npm uninstall babel-plugin-istanbul

# Install the maintained fork as a development dependency
npm install --save-dev @pkg-nec/babel-plugin-istanbul

Update the Babel plugin reference in the test environment:

{
  "env": {
    "test": {
      "plugins": ["@pkg-nec/babel-plugin-istanbul"]
    }
  }
}

Existing plugin options and nyc configuration stay the same.

• We only merge security patches and critical bug fixes from upstream
• We track the Node.js Active LTS and Current release lines
• Every release is published with npm provenance for supply-chain transparency
• See each repo's FORK_POLICY.md for full details

Find this work useful? Buy me a coffee ☕