{
  "readable": true,
  "as_of": "2026-10-03",
  "source": "core/mcp_chokepoint_maintainers.cjs",
  "as_of_is_stamped_by": "the producer, not this reader",
  "measured_server_population": 10071,
  "packages_profiled": 90,
  "resolved": 90,
  "undetermined": 0,
  "sole_maintainer": 41,
  "dormant_2y": 31,
  "dormant_5y": 22,
  "criterion": "exactly 1 maintainer AND last publish >= 5 years before as_of",
  "hits": [
    {
      "pkg": "once",
      "servers": 8181,
      "pct": 81.23,
      "maintainers": 1,
      "maintainer": "isaacs",
      "last_publish": "2016-09-06",
      "dormant_years": 10.1,
      "version": "1.4.0"
    },
    {
      "pkg": "wrappy",
      "servers": 8181,
      "pct": 81.23,
      "maintainers": 1,
      "maintainer": "isaacs",
      "last_publish": "2016-05-17",
      "dormant_years": 10.4,
      "version": "1.0.2"
    },
    {
      "pkg": "path-key",
      "servers": 8092,
      "pct": 80.35,
      "maintainers": 1,
      "maintainer": "sindresorhus",
      "last_publish": "2021-04-09",
      "dormant_years": 5.5,
      "version": "4.0.0"
    },
    {
      "pkg": "shebang-command",
      "servers": 8084,
      "pct": 80.27,
      "maintainers": 1,
      "maintainer": "kevva",
      "last_publish": "2019-09-06",
      "dormant_years": 7.1,
      "version": "2.0.0"
    },
    {
      "pkg": "shebang-regex",
      "servers": 8084,
      "pct": 80.27,
      "maintainers": 1,
      "maintainer": "sindresorhus",
      "last_publish": "2021-08-13",
      "dormant_years": 5.1,
      "version": "4.0.0"
    },
    {
      "pkg": "safer-buffer",
      "servers": 8068,
      "pct": 80.11,
      "maintainers": 1,
      "maintainer": "chalker",
      "last_publish": "2018-04-08",
      "dormant_years": 8.5,
      "version": "2.1.2"
    },
    {
      "pkg": "inherits",
      "servers": 8055,
      "pct": 79.98,
      "maintainers": 1,
      "maintainer": "isaacs",
      "last_publish": "2019-06-19",
      "dormant_years": 7.3,
      "version": "2.0.4"
    },
    {
      "pkg": "depd",
      "servers": 8048,
      "pct": 79.91,
      "maintainers": 1,
      "maintainer": "dougwilson",
      "last_publish": "2018-10-26",
      "dormant_years": 7.9,
      "version": "2.0.0"
    },
    {
      "pkg": "escape-html",
      "servers": 8048,
      "pct": 79.91,
      "maintainers": 1,
      "maintainer": "dougwilson",
      "last_publish": "2015-09-01",
      "dormant_years": 11.1,
      "version": "1.0.3"
    },
    {
      "pkg": "setprototypeof",
      "servers": 8048,
      "pct": 79.91,
      "maintainers": 1,
      "maintainer": "wesleytodd",
      "last_publish": "2019-07-18",
      "dormant_years": 7.2,
      "version": "1.2.0"
    },
    {
      "pkg": "fast-deep-equal",
      "servers": 7953,
      "pct": 78.97,
      "maintainers": 1,
      "maintainer": "esp",
      "last_publish": "2020-06-08",
      "dormant_years": 6.3,
      "version": "3.1.3"
    },
    {
      "pkg": "require-from-string",
      "servers": 7953,
      "pct": 78.97,
      "maintainers": 1,
      "maintainer": "floatdrop",
      "last_publish": "2018-04-09",
      "dormant_years": 8.5,
      "version": "2.0.2"
    },
    {
      "pkg": "json-schema-traverse",
      "servers": 7948,
      "pct": 78.92,
      "maintainers": 1,
      "maintainer": "esp",
      "last_publish": "2020-12-13",
      "dormant_years": 5.8,
      "version": "1.0.0"
    }
  ],
  "hit_count": 13,
  "maintainer_concentration": [
    {
      "maintainer": "isaacs",
      "packages": [
        "once",
        "wrappy",
        "inherits"
      ],
      "count": 3
    },
    {
      "maintainer": "sindresorhus",
      "packages": [
        "path-key",
        "shebang-regex"
      ],
      "count": 2
    },
    {
      "maintainer": "dougwilson",
      "packages": [
        "depd",
        "escape-html"
      ],
      "count": 2
    },
    {
      "maintainer": "esp",
      "packages": [
        "fast-deep-equal",
        "json-schema-traverse"
      ],
      "count": 2
    },
    {
      "maintainer": "kevva",
      "packages": [
        "shebang-command"
      ],
      "count": 1
    },
    {
      "maintainer": "chalker",
      "packages": [
        "safer-buffer"
      ],
      "count": 1
    },
    {
      "maintainer": "wesleytodd",
      "packages": [
        "setprototypeof"
      ],
      "count": 1
    },
    {
      "maintainer": "floatdrop",
      "packages": [
        "require-from-string"
      ],
      "count": 1
    }
  ],
  "individuals_controlling_all_hits": 8,
  "negative_controls": [
    {
      "pkg": "zod",
      "servers": 8534,
      "pct": 84.74,
      "maintainers": 1,
      "maintainer": "colinhacks",
      "last_publish": "2026-09-13",
      "dormant_years": 0.1,
      "version": "4.6.5"
    },
    {
      "pkg": "@hono/node-server",
      "servers": 8133,
      "pct": 80.76,
      "maintainers": 1,
      "maintainer": "yusukebe",
      "last_publish": "2026-09-29",
      "dormant_years": 0,
      "version": "2.1.3"
    },
    {
      "pkg": "jose",
      "servers": 8110,
      "pct": 80.53,
      "maintainers": 1,
      "maintainer": "panva",
      "last_publish": "2026-09-05",
      "dormant_years": 0.1,
      "version": "6.2.12"
    },
    {
      "pkg": "isexe",
      "servers": 8087,
      "pct": 80.3,
      "maintainers": 1,
      "maintainer": "isaacs",
      "last_publish": "2026-02-09",
      "dormant_years": 0.6,
      "version": "4.0.0"
    },
    {
      "pkg": "eventsource-parser",
      "servers": 8086,
      "pct": 80.29,
      "maintainers": 1,
      "maintainer": "rexxars",
      "last_publish": "2026-09-15",
      "dormant_years": 0,
      "version": "4.1.1"
    },
    {
      "pkg": "es-object-atoms",
      "servers": 8082,
      "pct": 80.25,
      "maintainers": 1,
      "maintainer": "ljharb",
      "last_publish": "2026-05-22",
      "dormant_years": 0.4,
      "version": "1.1.2"
    },
    {
      "pkg": "pkce-challenge",
      "servers": 8081,
      "pct": 80.24,
      "maintainers": 1,
      "maintainer": "crouchcd",
      "last_publish": "2026-02-01",
      "dormant_years": 0.7,
      "version": "6.0.0"
    },
    {
      "pkg": "side-channel",
      "servers": 8051,
      "pct": 79.94,
      "maintainers": 1,
      "maintainer": "ljharb",
      "last_publish": "2026-06-08",
      "dormant_years": 0.3,
      "version": "1.1.1"
    },
    {
      "pkg": "side-channel-list",
      "servers": 8051,
      "pct": 79.94,
      "maintainers": 1,
      "maintainer": "ljharb",
      "last_publish": "2026-04-08",
      "dormant_years": 0.5,
      "version": "1.0.1"
    },
    {
      "pkg": "hono",
      "servers": 8050,
      "pct": 79.93,
      "maintainers": 1,
      "maintainer": "yusukebe",
      "last_publish": "2026-09-30",
      "dormant_years": 0,
      "version": "4.13.12"
    },
    {
      "pkg": "ipaddr.js",
      "servers": 8048,
      "pct": 79.91,
      "maintainers": 1,
      "maintainer": "whitequark",
      "last_publish": "2026-08-04",
      "dormant_years": 0.2,
      "version": "2.5.0"
    },
    {
      "pkg": "ip-address",
      "servers": 7930,
      "pct": 78.74,
      "maintainers": 1,
      "maintainer": "beaugunderson",
      "last_publish": "2026-10-01",
      "dormant_years": 0,
      "version": "10.7.3"
    },
    {
      "pkg": "zod-to-json-schema",
      "servers": 7916,
      "pct": 78.6,
      "maintainers": 1,
      "maintainer": "stefan-terdell",
      "last_publish": "2026-03-27",
      "dormant_years": 0.5,
      "version": "3.25.2"
    },
    {
      "pkg": "json-schema-typed",
      "servers": 7910,
      "pct": 78.54,
      "maintainers": 1,
      "maintainer": "remyrylan",
      "last_publish": "2025-11-17",
      "dormant_years": 0.9,
      "version": "8.0.2"
    }
  ],
  "negative_control_count": 14,
  "negative_control_criterion": "exactly 1 maintainer AND last publish < 1 year before as_of — same reach, same sole control, actively maintained",
  "framing": "EXPOSURE, NOT ACCUSATION. States measured reach, maintainer count and publish recency from public npm metadata. Asserts no wrongdoing by any maintainer and no vulnerability in any package. A dormant package is not a compromised package."
}