Security-focused maintainers of abandoned npm packages.
We fork unmaintained Node.js packages, ship security patches, and keep the ecosystem safe — without introducing new features or breaking changes.
| 🔒 | Patch CVEs and security vulnerabilities in unmaintained packages |
| ♻️ | Drop-in replacements — same API, same CLI, stricter Node.js engine targets |
| 📦 | Published under @pkg-nec/* on npm with full provenance attestation |
| 🚫 | No new features — stability and security only |
| Package | Replaces | npm |
|---|---|---|
pkg-nec/http-server |
http-party/http-server (unmaintained since 2022) |
 |
Switching is a one-line change. No code changes required.
# Remove the unmaintained package
npm uninstall http-server
# Install the maintained fork
npm install @pkg-nec/http-server
# Or run on-demand with no install
npx @pkg-nec/http-server [path] [options]The binary name (http-server) stays the same.
- We only merge security patches and critical bug fixes from upstream
- We track the Node.js Active LTS and Current release lines
- Every release is published with npm provenance for supply-chain transparency
- See each repo's
FORK_POLICY.mdfor full details
Find this work useful? Buy me a coffee ☕