dinerojs/dinero.js: Watch · Upstream Weekly

Decision in one minute

dinerojs/dinero.js has received a Watch verdict with an overall score of 50. Key drivers for concern include that one contributor authored 99 percent of commits in the last 365 days, maintainers responded to 0 percent of sampled items, and checks on the default branch are failing. The project does, however, maintain positive adoption with 424,461 downloads last week on npm.

Strengths

6 releases in the last 365 days.
Source: 6 releases in the last 365 days.
Licensed under MIT (OSI-approved).
Source: Licensed under MIT (OSI-approved).
424,461 downloads last week on npm.
Source: 424,461 downloads last week on npm.

Concerns

One contributor authored 99 percent of commits in the last 365 days (low bus factor).
Source: One contributor authored 99 percent of commits in the last 365 days (low bus factor).
Maintainers responded to 0 percent of sampled items.
Source: Maintainers responded to 0 percent of sampled items.
Checks on the default branch are failing.
Source: Checks on the default branch are failing.

Verify before adopting

Inspect the failing checks on the default branch to assess build stability.Source: Checks on the default branch are failing.
Evaluate project sustainability given that one contributor authored 99 percent of commits in the last 365 days.Source: One contributor authored 99 percent of commits in the last 365 days (low bus factor).
Review open pull requests and issues to assess responsiveness beyond the sampled items.Source: Maintainers responded to 0 percent of sampled items.
Determine reporting procedures for vulnerabilities given that no security policy (SECURITY.md) was found.Source: No security policy (SECURITY.md) was found.

Uncertainty: Responsiveness metrics were derived from a limited sample of 3 issues and 3 pull requests.

Written by Gemini Flash from the metrics and reasons below; every number was checked against the data, and the verdict and score come from fixed rules, not the model.

Explained

Why this verdict

5 concerns10 neutral3 positive

Score 50 from 100% of the weight; 1 hard gate applied.

ConcernHard gate: One contributor authored 99 percent of commits in the last 365 days (low bus factor).
ConcernNone of the sampled items received a response from someone other than the author (sample of 3 issues and 3 pull requests).
ConcernMaintainers responded to 0 percent of sampled items.
ConcernNo security policy (SECURITY.md) was found.
ConcernChecks on the default branch are failing.
NeutralOpenSSF Scorecard score is 4 out of 10.
NeutralNo GitHub security advisories published in the last 365 days.
NeutralLast commit to the default branch was 104 days ago.
Neutral207 commits in the last 365 days.
NeutralOSV has no vulnerability records for dinero.js (npm).
NeutralLast release was 219 days ago (v2.0.2).
NeutralMedian gap between releases over the last 2 years: 4 days.
Neutral3 people committed in the last 365 days.
NeutralGitHub community profile is 75 percent complete (informational).
Neutral6,806 GitHub stars (a weak signal on its own).
Positive6 releases in the last 365 days.
PositiveLicensed under MIT (OSI-approved).
Positive424,461 downloads last week on npm.

Breakdown

Nine dimensions

Security posture
Weight 20
40Risky
Source values
OpenSSF Scorecard
4 / 10OpenSSF Scorecard API · 19 Oct 2026, 05:16 UTC
Scorecard date
2026-10-12OpenSSF Scorecard API · 19 Oct 2026, 05:16 UTC
Advisories (365 days)
0GET /repos/{o}/{r}/security-advisories · 19 Oct 2026, 05:16 UTC
Known vulnerabilities
Weight 15
100Healthy
no records in OSV
Source values
Package
npm: dinero.jsEntered in admin
Latest version
2.0.2registry.npmjs.org · 19 Oct 2026, 05:16 UTC
Known vulnerabilities (all versions)
0OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
With a fixed version
0OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Affecting the latest version
0queried with 2.0.2OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Published in last 365 days
0OSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Most recent published
Not availableNo vulnerability recordsOSV.dev POST /v1/query · 19 Oct 2026, 05:16 UTC
Maintenance
Weight 15
45Risky
Source values
Archived
NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Disabled
NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Days since last default-branch commit
104 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Commits in last 365 days
207GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Release cadence
Weight 10
56Watch
Source values
Days since last release
219 daysGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:16 UTC
Releases in last 365 days
6GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:16 UTC
Median days between releases (2 years)
4 daysover the last 2 yearsGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:16 UTC
Uses GitHub Releases
YesGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:16 UTC
Latest release
v2.0.2GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:16 UTC
Responsiveness
Weight 10
0Risky
sampled (6 items)
Source values
Issues sampled
3issues updated in the last 90 days, PRs excluded, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Pull requests sampled
3pull requests updated in the last 90 days, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Median time to first response
Not availableNo sampled item had a response from someone other than its authorGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Share with a maintainer response
0%sampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:16 UTC
Maintainer depth
Weight 10
38Risky
Source values
Distinct contributors (365 days)
3GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Top contributor's share of commits
99%GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Top contributor
sarahdayanGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Low bus factor
YesGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:16 UTC
Governance and licensing
Weight 10
60Watch
Source values
License (SPDX)
MITGET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
License status
OSI-approvedGET /repos/{owner}/{repo} + OSI list · 19 Oct 2026, 05:16 UTC
Security policy
NoGET /repos/{o}/{r}/contents/SECURITY.md (+ .github/, docs/) · 19 Oct 2026, 05:16 UTC
Code of conduct (info)
YesGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Contributing guide (info)
YesGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Issue templates (info)
NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
Community profile (info)
75%GET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:16 UTC
CI health
Weight 5
20Risky
Source values
Default-branch checks
FailingGET /repos/{o}/{r}/commits/{sha}/check-runs · 19 Oct 2026, 05:16 UTC
Method
check-runsGitHub · 19 Oct 2026, 05:16 UTC
Adoption
Weight 5
82Healthy
Source values
Weekly downloads
424,461npm (last 7 days) · 19 Oct 2026, 05:16 UTC
Stars (weak signal)
6,806GET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Forks (weak signal)
205GET /repos/{owner}/{repo} · 19 Oct 2026, 05:16 UTC
Dependents
Not availableNot collected: no reliable public source without scraping— · 19 Oct 2026, 05:16 UTC

Over time

Trend

Score moved from 56 to 50; the verdict stayed Watch.
Responsiveness gained data on the last refresh (No data → Risky).

2026-W42 WatchScore 5690% coverage
2026-W43 WatchScore 50100% coverageShown above

History

Decision log

No decision recorded yet. Status: Evaluating.