Study finds AI-style stale version pins in 13.7% of new npm packages in 2026 H1

Kobi Mozgori sampled 250,000 npm packages and found that new packages whose pinned dependency versions are mostly round x.0.0 numbers already superseded rose from a 1–2.4% baseline in 2019 to early 2024 to 13.7% in 2026 H1, falling to 7.6% in 2026 H2 through early November. The median pinned dependency was about 155 days old at birth in 2021–2023 but 451 days in 2026 Q2, and the share of packages born with essentially all pins on the newest release dropped from about 28% to about 10%. The author frames the pattern as an inference rather than proof, since registry metadata cannot show who or what wrote a manifest, and notes the decline since mid-2026 is unexplained.