whoholdsup

Who holds up your app? Point it at your lockfile and it shows how many of your dependencies are kept alive by a single person, which haven't shipped in years, and which recently changed hands.

uvx whoholdsup          # in any project with a lockfile

_{Real output for a typical Next.js + Express app (the lockfile is in docs/example), November 2026.}

In 2024, a backdoor came within weeks of shipping in the stable releases of major Linux distros through xz, a compression library maintained by one exhausted volunteer who handed releases to a helpful newcomer. Your app has hundreds of packages just like it. whoholdsup tells you which ones.

What it checks

It also works out which single-maintainer packages are load-bearing: how many other packages in your tree depend on each one, directly or indirectly. And it shows the people holding it up: who is the sole maintainer of the most packages you use.

Organisation and release-bot accounts (types for DefinitelyTyped, PyPI organisations, GitHub Actions trusted publishing) aren't counted as one person.

Supported lockfiles

Direct dependencies are marked using your package.json or pyproject.toml.

Options

whoholdsup                       # current folder
whoholdsup path/to/project       # another folder
whoholdsup uv.lock yarn.lock     # specific lockfiles
whoholdsup --direct              # only packages you depend on directly
whoholdsup --top 25              # longer tables
whoholdsup --json                # everything, machine-readable (for CI)
whoholdsup --no-cache            # ignore the one-day lookup cache

How it works

whoholdsup reads your lockfile locally, then asks the public registries about each package: registry.npmjs.org for npm packages, and PyPI's JSON API, XML-RPC package_roles and project pages for Python. Lookups run 16 at a time and are cached for a day, so a second run is instant. Nothing about your project is uploaded anywhere: the registries only see package names, the same as when you install them.

Honest limits. "One maintainer" means one account with publish rights. That's the risk that matters for supply-chain attacks, but some single accounts are backed by a company, and some multi-maintainer packages are really run by one tired person. The publisher-change signal is npm-only, because PyPI doesn't publish who uploaded each release.

Install

uvx whoholdsup          # run without installing
pipx install whoholdsup # or install it

Requires Python 3.9+. The only dependency is rich (plus tomli on Python < 3.11).

License

MIT