PkgWatch

A VS Code extension that scans your package.json and flags dependencies with End of Life warnings, CVE security advisories, npm deprecations, and abandoned packages — all inline, without leaving your editor.

What it does

When you open a package.json, the extension automatically runs 5 checks per dependency:

1. endoflife.date — checks if the installed major version has reached or is approaching End of Life
2. npm registry — detects packages officially deprecated by their maintainer, plus latest version and last publish date
3. ecosyste.ms — detects abandoned packages (archived repo or no release in 3+ years)
4. OSV.dev — queries for known CVEs against the installed version
5. GitHub Advisory Database — additional security advisories, deduplicated against OSV results

Results appear as inline hints, hover tooltips, Problems panel entries, and a sidebar dashboard. No configuration required.

Support this project

PkgWatch is built and maintained independently. If it saves you time, consider supporting future development:

Inline hints

Hints appear directly next to the version string in package.json. Packages with no issues show nothing — the file stays clean.

CVE badges appear at the end of the line (not on the version string):

Hint priority is managed automatically — if a package is EOL, the deprecated hint won't stack on top. If deprecated, the grey "latest" hint won't appear. One signal per package at a time.

Hover tooltip

Hover over any version string to see the full picture for that package:

• EOL status and exact date
• Recommended upgrade version
• Last published date (from npm)
• Deprecation message (if deprecated)
• Abandoned/archived reason with time since last release
• Data source used
• Full CVE list with severity, advisory ID (clickable link), summary, fixed-in version, and affected version range

Up to 5 CVEs are shown inline. If there are more, a link to OSV.dev is provided.

Problems panel

All findings are also reported to VS Code's built-in Problems tab — the same place TypeScript errors appear. This means you can see all flagged packages across your project at once without opening individual files.

CVE entries have a clickable link directly to the advisory page.

Open the Problems tab: Ctrl/Cmd + Shift + M

Security dashboard (sidebar)

Click the shield icon in the Activity Bar on the left to open the PkgWatch panel.

The dashboard shows:

• 6 summary cards: EOL count, approaching EOL, packages with CVEs, critical CVE count, npm deprecated count, abandoned/archived count
• Package list sorted by severity (critical CVEs first, then EOL, then deprecated, then abandoned)
• Per-package detail: EOL date, deprecation message, abandoned reason, last published date, upgrade recommendation, full CVE list with fix info

Only packages with at least one issue appear in the list. All-clear projects show a green confirmation.

Output channel

To see exactly what the extension is doing — especially useful when a package is not getting detected:

1. Open the Output panel: Ctrl/Cmd + Shift + U
2. Select PkgWatch from the dropdown

The log shows every step: how many packages were found, which matched endoflife.date, which are not in the EOL map (with a suggestion to add them), what CVEs were found from each source, and any API errors.

Example output:

[PkgWatch] Scanning /project/package.json — 24 packages found
  next@13.5.0 → EOL status: eol (2024-04-26)
  react@18.2.0 → EOL status: ok
  react@18.2.0 → npm latest: 18.3.1, last published: 2024-04-26
  @googlemaps/js-api-loader@1.16.2 → not in eolMap, npm latest: 1.16.6
  request@2.88.2 → ⚠ DEPRECATED on npm: "request has been deprecated"
  left-pad@1.3.0 → ecosyste.ms: abandoned — No release in 8 years
  next@13.5.0 → 2 CVE(s) from OSV.dev: GHSA-xxxx-yyyy, CVE-2024-34351
  crypto-js@4.1.1 → 1 CVE(s) from OSV.dev: GHSA-xwcq-pm8m-c4vf
[PkgWatch] Done — 1 EOL, 0 approaching, 2 with CVEs (1 critical), 1 deprecated, 1 abandoned

Data sources

All 5 sources are free. None require API keys to function, though GitHub Advisory performs better with a personal access token due to rate limits.

Adding packages to EOL tracking

If you see not in eolMap in the Output Channel for a package you want tracked, add it to src/eolMap.ts:

'your-package-name': 'endoflife-slug',

The slug is the URL path on endoflife.date. For example:

• https://endoflife.date/nextjs → slug is nextjs
• https://endoflife.date/nodejs → slug is nodejs

Verify the slug exists before adding it. If a package has no endoflife.date entry (e.g. @googlemaps/js-api-loader, lodash, axios), the extension still covers it via npm deprecation, ecosyste.ms health checks, and CVE detection — you just won't get lifecycle dates.

Commands

Open the Command Palette (Ctrl/Cmd + Shift + P):

Settings

Search for PkgWatch in VS Code settings:

Caching

All API responses are cached in VS Code's global state to avoid hammering APIs on every keystroke.

• Default cache duration: 12 hours
• Cache is keyed per-package and per-version — changing a version string in package.json immediately triggers a fresh fetch for that package
• To force a full refresh: PkgWatch: Clear Cache

Limitations

• EOL lifecycle dates are only available for packages tracked on endoflife.date, which covers major frameworks and runtimes. Utility libraries like lodash or axios are not tracked there — they fall back to npm deprecation and ecosyste.ms signals instead, and CVEs are still checked.
• npm deprecation only fires if the maintainer explicitly set the deprecated field on npm. A dead package with no official deprecation won't show the orange hint — ecosyste.ms covers this case instead.
• Abandoned heuristic uses a 3-year no-release threshold. Some packages are intentionally stable and release rarely (e.g. semver, mime-types) — check the last published date in the hover tooltip before acting on this signal.
• GitHub Advisory rate limit is 60 requests/hour without authentication. Hitting the limit means some advisory results may be missing for that session. OSV.dev is unaffected and covers most of the same CVEs.
• The extension only reads package.json. It does not inspect node_modules, package-lock.json, or yarn.lock.