I Scanned 260 Packages that your are using and Found 43 With Security Vulnerabilities

I Scanned 260 Packages and Found 43 With Security Vulnerabilities

I was poking around node_modules and found something disturbing.

The biggest frameworks in our ecosystem: Express, Next.js, NestJS. All depend on packages that haven't been touched in 5 years. No tests. No quality checks. No active maintainer.

Just dormant code that millions of projects blindly trust.

The challenge I found

ms — ReDoS vulnerability
debug — regex injection via env variable
function-bind — uses Function() constructor

All sitting at the bottom of the dependency tree, silently running in production.

The added value

What if we put them all in one place? Same boilerplate. Same quality controls. Same CI.

The result: 165 packages, all faster than the originals, all zero-dep, all typed, all tested.

Quality matters

I built this with a custom quality system called CPM (Code Package Manager) that enforces:

100% branch coverage on all 888 tests
TypeScript strict mode with generics and type guards
Zero dependencies per package
Consistent exports with types condition
CI pipeline with multiple reviewers

This isn't just a rewrite — it's a proven, maintainable alternative.

Impact

Framework	Replaceable deps	After flupke
Expo	108	Tested, typed, zero-dep
Nuxt	71	Tested, typed, zero-dep
Jest	63	Tested, typed, zero-dep
Express	44	Tested, typed, zero-dep
NestJS	8	Tested, typed, zero-dep