esbuild has 190M weekly downloads and one maintainer — I audited 25 top npm packages

A zero-install audit of 25 popular npm packages found several high-download libraries are maintained by just one person.

Packages such as esbuild, chalk, axios, sharp, TypeScript, webpack, and prettier combine massive weekly usage with concentrated maintainer risk.

The report argues this creates outsized supply-chain exposure: a compromise of one maintainer or account could impact millions of downstream users.

Traditional tools like npm audit may miss this structural risk, especially in transitive dependencies and packages with no known CVEs.