Study finds AI-style version pins in 13.7% of new npm packages
Start here
Kobi Mozgori sampled 250,000 npm packages at random and examined the dependency versions each named in its first release, finding that new packages whose pinned versions are mostly round x.0.0 numbers already superseded rose from a 1–2.4% baseline in 2019 to early 2024 to 13.7% in 2026 H1. The share fell to 7.6% in 2026 H2 through early November, a decline Mozgori says is unexplained. The median pinned dependency was about 155 days old at birth in 2021–2023 but 451 days in 2026 Q2, and the share of packages born with essentially all pins on the newest release dropped from about 28% to about 10%. Mozgori frames the pattern as an inference rather than proof: registry metadata cannot show who or what wrote a manifest. The data covers npm only and first releases only, from a sample taken on one day.
Generated from reports · updated 5 h ago
Report timeline
Follow the reports to see the event from different sides.
- Hacker News · AIStudy finds AI-style stale version pins in 13.7% of new npm packages in 2026 H1
Kobi Mozgori sampled 250,000 npm packages and found that new packages whose pinned dependency versions are mostly round x.0.0 numbers already superseded rose from a 1–2.4% baseline in 2019 to early 2024 to 13.7% in 2026 H1, falling to 7.6% in 2026 H2 through early November. The median pinned dependency was about 155 days old at birth in 2021–2023 but 451 days in 2026 Q2, and the share of packages born with essentially all pins on the newest release dropped from about 28% to about 10%. The author frames the pattern as an inference rather than proof, since registry metadata cannot show who or what wrote a manifest, and notes the decline since mid-2026 is unexplained.
Heat for this event
Not enough continuous observations yet to draw a trend.