The signal is very much not that software with no commits is bad, it's just very common to have half-finished projects or very buggy packages which are no longe

The signal is very much not that software with no commits is bad, it's just very common to have half-finished projects or very buggy packages which are no longer maintained. I'd say the quantity of those greatly outweighs the quantity without relatively recent commits which are good. This means that, as a very coarse heuristic, it's probably a good idea to be fairly skeptical of projects without somewhat recent commits, if only they're to keep up with the latest npm update or whatever.