This is a submission for Weekend Challenge: Generosity Edition
What I Built
My first three ideas were a donation tracker, a volunteer matcher, and a transparency dashboard for a nonprofit. All fine. All things a hundred other people were about to build.
Then I noticed something about my own week. I had installed roughly four hundred packages. I had thanked exactly zero people. Not because I am ungrateful — because I never once saw a face.
The largest act of generosity most developers take part in is one we are on the receiving end of, every single day, and it is completely invisible to us.
So I built Nebraska. You give it a package.json. It finds the people underneath it, ranks them by how much weight they carry against how little support comes back, and gives you something to actually send to the person at the top of that list.
The name is xkcd 2347 — all modern digital infrastructure, balanced on a project some random person has been thanklessly maintaining since 2003. Nebraska draws that comic using your real dependency tree.
Demo
→ marcelo-henry.github.io/nebraska — no signup, no API key, about eight seconds.
Paste a package.json, a GitHub URL, or just a package name. Here is Express, the most-used framework in Node:
Every brick is a package Express ships, coloured by how much it owes them. The load gathers at the bottom. The whole wall rests on one pillar.
Forty-six packages. Seventy-nine people. Fifteen of those packages are kept alive by one person, and fourteen of them have no way to accept money at all.
Filter the ledger down to the solo maintainers and it stops being abstract:
1 depd one person 150M/wk No way to pay them (last push 2024)
2 once one person 157M/wk No way to pay them (last push 2025)
3 accepts one person 148M/wk No way to pay them (last push 2026)
4 on-finished one person 138M/wk No way to pay them (last push 2026)
5 fresh one person 137M/wk No way to pay them (last push 2026)
A hundred and fifty million downloads a week, each, and not a single funding link between them. That is not a bug in npm. That is what the foundation looks like when you finally point a light at it.
The one at the top is the one the comic is actually about. depd has a single maintainer, no way to accept money, and a repository nobody has pushed to since 2024. Quiet and load-bearing at the same time.
Open any row and you get the maintainer handles, the funding link if one exists, and a note you can send:
@kael — you maintain ignore by yourself.
It was downloaded 312 million times last week. One of those was my project. I never installed it directly — it came in underneath something else I chose, which is why it took me this long to look.
There is no funding link on it, so there is nothing for me to click. I can at least write this.
Thank you. Genuinely.
There is also a THANKS.md you can commit next to your README.
Code
Marcelo-Henry
/
nebraska
Paste a package.json. Find the people holding up your project. xkcd 2347, drawn with your real dependency tree.
Nebraska
Paste a package.json. Find the people underneath it.
Every project you ship stands on work somebody gave away. Nebraska walks your dependency tree, finds the humans behind it, and ranks the packages by how much weight they carry against how little support comes back — then gives you a way to say something to the person at the top of that list.
The drawing above is Express. Forty-six packages, seventy-nine people. Fifteen of
those packages are kept alive by one person, and fourteen of them have no way to
accept money at all. The pillar holding the whole thing up is depd — one
maintainer, no funding link, a hundred and fifty million downloads a week, and a
repository that has not been touched in years.
Open it · runs entirely in the browser, no build, no backend, no API key.
What it actually does
- Reads a
package.json…
Zero dependencies. A tool about dependency debt that adds to yours would be a bad joke. No build step, no bundler, no framework, no backend — plain ES modules served as static files, running entirely in your tab.
How I Built It
The score, published rather than hidden
The theme included "ethical and accountable giving", so a black-box number felt like the wrong move. Every signal is a pure function of public data, and the whole thing fits on one screen in src/score.js:
-
Reach is weekly downloads on a
log10scale. Going from a hundred users to a thousand matters more than ten million to eleven. - Support is maintainer count — saturating at four, because past that you have a team — plus a flat share for having any way to accept money at all.
- Silence raises the score once a repository is archived or has been quiet over a year. Abandoned and load-bearing is the exact failure the comic draws.
- Depth weighs a transitive dependency slightly lower, because you never chose it — which is precisely why you never thought to thank anyone for it.
Debt never reaches zero for a package you actually use. Being paid is not the same as being thanked, and I wanted the formula to say that out loud.
Three things I got wrong first
The 2.9 MB trap. The obvious way to read a package is to fetch its registry document. Do that for react and you get 2.9 MB, almost all of it every README ever published. The /latest endpoint returns the same maintainers, funding links and dependencies in about 2 KB. That single change is the difference between usable and unusable.
The bug that mattered most. Early runs on the same repo returned 112 packages, then 100, then 97. My retry logic only covered 5xx — but npm's CDN answers a burst with 429, which was falling straight through as a permanent failure. The tree was quietly shrinking, and the size of the tree is the entire claim this page makes. Now 429 backs off exponentially, and anything still unreadable is reported to you instead of silently dropped. Three runs in a row: 112, 112, 112.
Never block on the optional part. GitHub's anonymous limit is 60 requests an hour, and the archived-repo check was holding the whole report behind it — 28 seconds. Moving it off the critical path took that to 8. It now enriches the heaviest rows in the background, stops the instant the limit answers back, and tells you it was skipped rather than pretending it ran.
That last one changed a result, which is my favourite part. Without the GitHub signal, Express's pillar is once. With it, depd overtakes it — same lone maintainer, but a repo that has been silent since 2024. The tool found the more honest answer than the one I had.
Google AI
Every thank-you note has an offline version written from real numbers, and it is never a placeholder — that is the one quoted above. Paste a Google AI Studio key into a row and Gemini rewrites it knowing what the package actually does. The key stays in the tab, is held in memory only, and is sent to nobody but Google.
One writing detail I liked: quoting the npm description verbatim was the only construction that stayed grammatical for every package. Some read "A parser for X", others read "Run a function exactly one time" — splice either into a sentence and half your notes come out broken. There is a test for it.
What it deliberately does not do
It reads dependencies, not your lockfile, so it sees the tree you declare rather than the exact one you install. It counts npm maintainer accounts, which means a publishing bot counts as one person — so every row lists the actual handles, because a number that can mislead should show its work.
And it cannot tell you whether the person on the other end wants to hear from you. Read the note before you send it.
Prize Categories
Best Use of Google AI — Gemini writes the thank-you notes, using what each package actually does, with your own API key held only in the tab.
Run it on your own project. I would genuinely like to know who turns up at the bottom of your stack — drop the name in the comments. Somebody should say it to them.
Top comments (0)