Is this package dead?

Check a GitHub repo, an npm package or a PyPI package: archived, renamed, moved to a successor, deprecated, or simply abandoned. If it is, we suggest maintained, licence-cleared alternatives from JustClaw-It.

hashicorp/vault: Alive

No archive, rename, move or deprecation signal found.

Repository	hashicorp/vault
Last push	2026-10-28 (0 days ago)

Based on live GitHub data from 2026-10-29 07:38 UTC and our weekly dead/moved check of 2026-10-26.

Maintained, licence-cleared alternatives in JustClaw-It

tellerops/teller

Cloud native secrets management for developers - never leave your command line for secrets.

score 7.7/10 · Apache-2.0 permissive · 3,233 stars · 30 components · search them
argoproj-labs/argocd-vault-plugin

An Argo CD plugin to retrieve secrets from Secret Management tools and inject them into Kubernetes secrets

score 7.9/10 · Apache-2.0 permissive · 980 stars · 30 components · search them
infisical/infisical

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

score 4.8/10 · MIT permissive · 29,984 stars · 3,000 components · search them · alternatives
jkroepke/helm-secrets

A helm plugin that help manage secrets with Git workflow and store them anywhere

score 6.8/10 · Apache-2.0 permissive · 2,035 stars · 18 components · search them
pinterest/knox

Knox is a secret management service

score 6.9/10 · Apache-2.0 permissive · 1,271 stars · 37 components · search them
deepfence/secretscanner

:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

score 7.3/10 · MIT permissive · 3,401 stars · 15 components · search them

Questions

How do you decide a package is dead?

We check whether the GitHub repo is archived, deleted, renamed or transferred, read the start of its README for a deprecation or “we moved” notice, look at the npm deprecation flag or PyPI’s Inactive status and yanked releases, and measure the time since the last push.

Is no commits for a year a problem?

Not always: small, finished libraries can be stable for years. Treat it as a signal to look at open issues and security advisories, not as proof.

Let your agent pick maintained code. JustClaw-It is an MCP server with 1,518,000+ licence-cleared, quality-scored code components. Search is free; every result carries its licence and attribution.

Remote MCP endpoint: https://justclaw.it.com/mcp (API key auth). Works with Claude Code, Cursor, Codex, Windsurf and other MCP clients. A one-line CLI installer (@justclaw-it/cli) is coming.

Get a free API key Read the docs