Study: share of outdated dependency locks in new npm packages rises to 13.7%
Understand this story
Kobi Mozgori randomly sampled 250,000 npm packages, tallying the dependency versions locked in each package's first release, and found that the share of "round and already outdated" version locks (such as vitest ^2.0.0) rose from 1%–2.4% between 2019 and early 2024 to 13.7% (95% CI 13.1–14.4) in the first half of 2026. The result is being used as a version fingerprint of AI-generated code, but Mozgori says the data cannot prove who or what wrote any given package. The sample is limited to npm, limited to first published versions, and was collected on a single day. This change in proportion reflects the frequency with which such dependency locks appear in newly published packages, not a direct measurement of the degree of AI involvement.
AI overview based on source reports · Updated 1 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIFossil versions: a fingerprint of AI-written code in 250k NPM packages
A random sample of 250,000 npm packages found that the share of new packages whose first-release manifests pin mostly round, already-superseded versions (x.0.0) rose from 1–2.4% in every half-year from 2019 to early 2024 to 13.7% (95% CI 13.1–14.4) in the first half of 2026, falling to 7.6% in the second half of 2026. Median pin age at birth rose from about 155 days in 2021–2023 to 451 days in Q2 2026, and the share of packages born with essentially all pins on the newest release fell from about 28% to about 10%. The author argues the timing, the specific versions and how package managers work point to manifests written from a language model's memory rather than by running an install, while noting the data cannot prove who or what wrote any single package.
Activity for this story
- Current comparable activity
- 4
- Peak comparable activity
- 10Nov 13 17:00
- Change in the past 24 hours
- -49%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.