The Observatory: Oblivio

Every dependency you install is a bet that someone, somewhere, is still looking after it. Almost nobody checks whether that bet is still good. A library gets added in 2018, works fine, and quietly stops being touched, and the first anyone hears about it is a security report with no patch coming, because the one maintainer who understood the code moved on years ago and never said so out loud.

The Observatory is a free, public health check for those packages. It scores the most-depended-on libraries on npm, PyPI and NuGet against an open rubric, so "is this still maintained?" has an answer you can look up, instead of a feeling you get the day the build finally breaks.

We called the project Oblivio, because that's where these libraries are heading.

Where packages descend into oblivion. Slowly, and then all at once.

What "abandoned" actually means

The hard part isn't collecting the data. It's judging it fairly. A library that does one job, does it well, and hasn't needed a commit in two years isn't abandoned. It's finished. Brand it "at risk" for being quiet and you've just punished the most stable code in the ecosystem, and insulted a maintainer who did nothing wrong.

So the fairness rule is one line: with no sign of actual harm, a package never scores worse than stable. Being quiet is allowed. Being quiet while the security tab fills up, the pull requests pile unread, and the maintainer's last comment was a plea for help nobody answered, is a different thing, and only that trips the verdict down to slowing, at risk, or gone.

Abandoned isn't a moral failing. It's a risk you haven't priced.

How the score works

The verdict is a weighted sum of nine activity signals, each carrying a share of the whole:

verdict  =  weighted sum of nine signals   (Σ weight = 1.0)

  time since last release     0.12
  release cadence trend       0.08     speeding up, or slowing down
  commit activity             0.10     90- and 365-day windows
  issue response latency      0.12     how fast a new issue gets a reply
  pr merge latency            0.12     how long a contribution sits
  open pr backlog             0.10     unreviewed work piling up
  bus factor                  0.16     how many hands actually commit
  maintainer departure        0.14     the last active one going dark
  + harm signals                       override the fairness floor

Every verdict decomposes back to those numbers. Open any package and you can see which signal cost it what, the weight beside the raw value, the whole sum laid out. A health score you can't take apart is an opinion with a number bolted to it, and the whole point here was to build the opposite of that.

Feeding it is its own problem. Registry data comes from npm, PyPI and NuGet directly. The repository signals, commits, issues, pull requests, the shape of the contributor list, come through a GitHub App. And the universe it watches is the most-depended-on packages in each ecosystem, so it measures what the world genuinely leans on, not a random sample that flatters the numbers.

The number at the top

The homepage opens with one figure: the share of the most-depended-on packages we track that show abandonment signals. It's a blunt number, and blunt is the point. The industry keeps treating maintenance as a thing that just happens, done for free by people who are, on the whole, tired. The number is there to make that stop feeling free.

Built to cost nothing

Because it's free and public, it had to run for roughly nothing, so there's no server sitting idle between visits. A serverless Postgres keeps an append-only history of every score a package has ever had. A scheduled job wakes on a cadence, takes the stalest packages, scores them against the live registries and their source repositories, and the pages rebuild themselves. The whole thing grows the universe it covers each time it runs, and the history is partitioned by month so it stays fast however many years pile up.

Where it sits

The Observatory is the open face of the same supply-chain surface OSPulse watches commercially. OSPulse tracks a company's own dependency estate for compromise and abandonment. This is the free, public view of the abandonment half, run across the whole ecosystem rather than one manifest, and it feeds on the same data.

And it's the patient sibling of PoisonBox. PoisonBox catches the package that tries to rob you at install time, the loud failure, all of it happening in one violent second. The Observatory catches the slow one: the library that stops being maintained, month by quiet month, until it's the soft target nobody was watching. Same dependency, two ways it lets you down.

PoisonBox catches the mugging. The Observatory catches the neglect.