Fossil versions: a fingerprint of AI-written code in 250k NPM packages

A random sample of 250,000 npm packages found that the share of new packages whose first-release manifests pin mostly round, already-superseded versions (x.0.0) rose from 1–2.4% in every half-year from 2019 to early 2024 to 13.7% (95% CI 13.1–14.4) in the first half of 2026, falling to 7.6% in the second half of 2026. Median pin age at birth rose from about 155 days in 2021–2023 to 451 days in Q2 2026, and the share of packages born with essentially all pins on the newest release fell from about 28% to about 10%. The author argues the timing, the specific versions and how package managers work point to manifests written from a language model's memory rather than by running an install, while noting the data cannot prove who or what wrote any single package.