Maintained forks of abandoned npm packages, kept current so their dependency trees don't rot.

Abandoned packages don't just stop getting features — they stop getting dependency updates. Every stale transitive dependency underneath an unmaintained package is a CVE waiting to happen, and nobody upstream will ever refresh it. unabandoned adopts these packages, publishes them under the @unabandoned/* npm scope, and points Renovate at them so the whole tree stays green.

This org is a holding area, not a mission: the packages here are ones our own projects depend on, forked and parked together instead of scattered through the organization where those projects live. They're published, documented and drop-in, so anyone downstream of the same abandoned libraries is welcome to use them — but the catalog grows from our dependency trees, not from a survey of the ecosystem.

Given a package our projects already pull in, the trigger is abandonment + any outdated dependency — not a live CVE. A CVE only changes the timeline (publish immediately), never whether we act.

The goal is a clean transitive dependency tree, all the way up — de-risking the whole tree, not just direct dependencies.

Each fork is a drop-in replacement for its upstream. Point your dependency at the @unabandoned scope:

{
  "dependencies": {
    "events": "npm:@unabandoned/events@^3"
  }
}

or install directly:

npm install @unabandoned/events

The public API matches upstream; only the maintenance model changes.

• Renovate runs against every fork, extending the shared unabandoned/renovate-config preset. It bumps dependencies (soaking new releases first) and auto-merges nightly once CI is green.
• Releases publish monthly by default; a merged security fix cuts an immediate out-of-cycle release.
• Packages publish with OIDC trusted publishing (provenance attestations), falling back to a scoped token only until OIDC is bootstrapped.
• CI runs on Node 20 / 22 / 24, plus CodeQL and OpenSSF Scorecard.

Shared CI, release, and publish logic lives here in unabandoned/.github as reusable workflows; each fork carries only a thin caller. See CONTRIBUTING.md for how to add a new fork.

Every fork's live status — pending Renovate updates, open PRs and issues, latest release, CI, any security fast-path in flight, and what each package is used for — is on the package dashboard. It's generated from each fork's own .unabandoned.yml plus the GitHub API and rebuilt on a schedule, so it's never hand-edited and can't drift. A dependency topology view maps the owned subtree — consumers, forks, and the shared leaves beneath them — coloured by live health, with every edge derived from package.json and used-by (nothing hand-drawn).

Beyond status, it answers the questions that actually decide work: a work queue ranking interventions by how much rot each one removes rather than how often a package appears, and intake for auditing a dependency tree — or comparing any two repositories — before adopting it. Anything measured but unmeasurable is reported as unknown rather than assumed healthy, and every build carries its own integrity verdict. A machine-readable copy is at observation.json.

See SECURITY.md. Reporting CVEs in these trees — and getting a fix shipped fast — is the whole point of forking it.