I've been seeing the same line at the bottom of every npm install for years:
added 47 packages, and 12 packages are looking for funding
run `npm fund` for details
I've never once run that command. It felt like a nag — the software equivalent of "did you mean to donate?" So last week, out of pure curiosity, I typed it.
What I got was a tree. Not a guilt trip, not a paywall — just a list of 12 packages I use every single day, each with a link to the human being who keeps it alive. Most of them I'd never heard of. A few I'd been taking for granted my entire career.
I picked five to look into. Here's what I found.
chalk — The One That Almost Died
chalk is the package that colors your terminal output. If you've ever seen a green "success" or a red "error" in a CLI tool, there's a good chance chalk did that. It's maintained by Sindre Sorhus and Josh Junon, and it's downloaded billions of times a week.
In September 2025, Josh Junon was phished. Attackers got his npm account and pushed malicious, crypto-stealing versions of chalk and 19 other packages within 16 minutes. Wiz later reported that 99% of cloud environments used at least one affected package. Sindre published clean versions and locked out the compromised access, but the incident exposed something uncomfortable: a package that critical is held together by two people, one of whom was targeted by a single email.
chalk is funded through GitHub Sponsors. The money covers CI, security review, and the kind of redundancy (multi-maintainer, hardware keys, 2FA on everything) that would have stopped that attack cold.
dayjs — 76 Million Downloads, One Maintainer
dayjs is a 2kB date library that replaced moment.js for a lot of people. It's maintained by a single person, iamkun, and it pulls in over 76 million downloads per week.
The math here is the part that stuck with me. One person. 76 million downloads. The funding page points to both GitHub Sponsors and Open Collective, but the sponsor list is a handful of small logos. For a package that touches more production systems than most companies employ engineers, the financial support is… thin. If iamkun stopped, the migration would be chaotic and expensive — exactly the kind of risk that's cheap to prevent and expensive to clean up.
zustand — The Quiet Workhorse
zustand is a state management library for React, part of the pmndrs organization. It has 41 million weekly downloads and three maintainers: daishi (Daishi Kato), jeremyrh, and drcmda.
What impressed me is how understated the whole thing is. No enterprise backing, no VC, no "we're the future of state management" pitch. Just a FUNDING.json file in the repo pointing to GitHub Sponsors. The library is small, fast, and has zero dependencies — the kind of thing you install and forget. But "forget" is the wrong word. The right word is "depend on," and depending on something you never think about is the highest-risk state a dependency can be in.
The One That Made Me Stop
Then there was the small one. Buried in the tree, a package called sewline — something I'd never even seen before, a tiny utility that one of my other dependencies pulled in transitively. No stars to speak of, no blog posts, no Twitter account. Just a funding field in package.json pointing to a GitHub Sponsors page with two sponsors.
Two people are paying for this. And it's in my production build.
I'm sponsoring sewline this month. Not because it's famous. Because it's small enough that two people leaving would break it, and big enough that I'd notice. That's the exact spot where a package is most fragile — not the 76-million-download giants with a team of sponsors, but the quiet ones in the middle of the tree that nobody looks at.
Try It Yourself
# 1. Run it in any project
npm fund
# 2. See it as JSON (easier to parse)
npm fund --json
# 3. Open a specific package's funding page in your browser
npm fund dayjs
# 4. If a package has multiple funding sources, pick one
npm fund dayjs --which 1
# 5. Suppress the install-time notice if it bothers you
npm config set fund false
Run it in your biggest project. Count the packages. Then pick the one you know the least about and look it up. That's where the risk is hiding.
Top comments (0)