In an ecosystem like npm, having such thing is next to impossible. The useful libraries that don’t depend on anything else from npm are rare, and those that are

In an ecosystem like npm, having such thing is next to impossible. The useful libraries that don’t depend on anything else from npm are rare, and those that are need to review their lockfiles and run npm audit and whatnot every once in a while, even if their own code doesn’t change. Otherwise it’s quite a pain to integrate them with newer codebases. In any ecosystem at all: if it speaks HTTPS, it’s either never complete, or it ceases to function past some date. I get the sentiment very much, but there are cases when you can’t have nice things.