You already audit for CVEs. epitaph audits for abandonment. It reads your package.json, queries GitHub and npm, and grades every dependency A through F based on real maintenance signals. Bus factor 1, last human commit 14 months ago, maintainer account hijacked: epitaph finds it before it becomes your problem.

npx epitaph-dev

Run in any project with a package.json. No install, no config. Results in seconds.

  epitaph v0.1.0 -- scanning package.json (47 dependencies)

  GRADE  PACKAGE                 SIGNALS
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
    F    request                 ⚰️  Deprecated since Feb 2020
    F    event-stream            ⚰️  Archived · known supply chain incident
    D    cool-lib                👤  Bus factor: 1 · last human commit: 14mo ago
    C    legacy-helper           👤  Bus factor: 1 · active 2w ago
    B    ms                      📦  Stable (1M+ downloads, no issues)
    A    express                 🟢  12 contributors · funded · active
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  47 scanned · 2 dead · 1 warning · 1 caution · 43 healthy

Without a token, epitaph catches deprecated and archived packages using npm data only. With a token, you get commit history, bus factor, issue response times, and funding data. That is what powers the D and C grades.

Set as env var (recommended):

export GITHUB_TOKEN=your_token   # add to ~/.bashrc or ~/.zshrc

Or pass inline:

npx epitaph-dev --token YOUR_TOKEN

To create a token:

1. Go to github.com/settings/tokens
2. Click Generate new token (classic)
3. Give it a name like epitaph
4. Select scope: public_repo (read-only access to public repos)
5. Copy the token and set it as GITHUB_TOKEN

epitaph only reads public repository data. It never writes anything to GitHub.

Packages like ms or inherits have not been updated in years because they are finished, not abandoned. If a package has more than 1M weekly downloads and stable usage, epitaph floors the score at C. Finished is not the same as dead.

Add to your CI in one file. Runs on every PR that touches package.json and on a weekly schedule.

Create .github/workflows/epitaph.yml:

name: epitaph
on:
  schedule:
    - cron: '0 9 * * 1'  # every Monday 9am
  pull_request:
    paths: ['package.json']

jobs:
  health:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Ijtihed/epitaph@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fail-grade: D
          production-only: true

secrets.GITHUB_TOKEN is automatically provided by GitHub on every workflow run. No token setup required.

Create .epitaphrc.json in your project root, or run npx epitaph-dev init to generate one:

{
  "ignore": ["@types/*", "typescript", "prettier", "eslint"],
  "production-only": true,
  "fail-grade": "D",
  "cache-ttl": 24
}

epitaph [command] [options]

Commands:
  scan [default]         Scan dependency manifest for maintenance health
  init                   Generate .epitaphrc.json with smart defaults
  explain <package>      Deep-dive into one dependency's health signals

Options:
  -m, --manifest <path>  Path to manifest file (auto-detected if omitted)
  -t, --token <token>    GitHub personal access token
  -p, --production-only  Only scan production dependencies
  -j, --json             Output as JSON
  -v, --verbose          Show errors and extra details
  --ignore <packages>    Packages to ignore
  --fail-grade <grade>   Exit 1 if any dep scores at or below this grade
  --no-cache             Skip disk cache (fetch fresh data)

epitaph is the only tool that reads your manifest and grades every dependency for maintenance health.

Paste into Cursor, Claude Code, or Copilot inside your project:

Add epitaph to this project. Create .github/workflows/epitaph.yml that runs
on every PR using Ijtihed/epitaph@v1. Then run npx epitaph-dev locally and
fix any dependency health issues it finds.

MIT  ·  Built by Ijtihed