The most downloaded deprecated npm packages
Their own maintainers have retired them, yet npm serves these 27 packages about 1.42B times a week.
| package | npm downloads / week | last release | the maintainers' message |
|---|---|---|---|
| mimic-fn | 207M | Nov 2023 | Renamed to mimic-function |
| path-is-absolute | 129M | Nov 2018 | This package is no longer relevant as Node.js 0.12 is unmaintained. |
| inflight | 126M | Oct 2016 | This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and… |
| pkg-dir | 110M | Jun 2025 | Renamed to `package-directory`. |
| whatwg-encoding | 96M | Nov 2023 | Use @exodus/bytes instead for a more spec-conformant and faster implementation |
| node-domexception | 93M | Apr 2025 | Use your platform's native DOMException instead |
| find-cache-dir | 52.9M | Apr 2025 | Renamed to `find-cache-directory`. |
| lower-case | 50.9M | Sep 2023 | Use `str.toLocaleLowerCase` or `str.toLowerCase` |
| no-case | 50.4M | Sep 2023 | Use `change-case` |
| @babel/plugin-proposal-private-property-in-object | 50.2M | Jun 2023 | This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-property-in-object instead. |
| @opentelemetry/sdk-trace-node | 50.1M | Oct 2026 | Use @opentelemetry/sdk-trace package |
| p-finally | 48M | Apr 2021 | Deprecated |
| lodash.isequal | 47.7M | Jan 2017 | This package is deprecated. Use require('node:util').isDeepStrictEqual instead. |
| dot-case | 44.6M | Sep 2023 | Use `change-case` |
| read-pkg-up | 41.9M | Nov 2023 | Renamed to read-package-up |
| @humanwhocodes/object-schema | 39.7M | Apr 2024 | Use @eslint/object-schema instead |
| camel-case | 37.1M | Sep 2023 | Use `change-case` |
| param-case | 35.7M | Sep 2023 | Use `change-case` |
| pascal-case | 34M | Sep 2023 | Use `change-case` |
| tsconfck | 27.8M | May 2025 | unmaintained |
| abab | 26.5M | Apr 2022 | Use your platform's native atob() and btoa() methods instead |
| request | 14.3M | Feb 2020 | request has been deprecated, see https://github.com/request/request/issues/3142 |
| left-pad | 2.13M | Apr 2018 | use String.prototype.padStart() |
| tslint | 1.78M | Jul 2020 | TSLint has been deprecated in favor of ESLint. Please see https://github.com/palantir/tslint/issues/4534 for more information. |
| node-sass | 873K | May 2023 | Node Sass is no longer supported. Please use `sass` or `sass-embedded` instead. |
| protractor | 606K | May 2020 | We have news to share - Protractor is deprecated and will reach end-of-life by Summer 2023. To learn more and find out about other options please refer to this post on the Angular blog. Thank you… |
| phantomjs-prebuilt | 412K | Nov 2017 | this package is now deprecated |
From the packages we track, which grow nightly from npm's most downloaded. The top of the list is checked every night, the rest within a few weeks. Only packages whose latest version is deprecated count, and @types stubs are left out. The messages are the maintainers' words, shortened to 200 characters.
Why are they still downloaded?
Usually because other packages still require them. A deprecated package keeps working, and it stays in every lockfile and dependency tree that names it, so most of these downloads probably don't come from anyone choosing it today. Deprecated doesn't always mean dangerous either: many entries here were simply renamed.
How do I check for deprecated packages in my project?
npm installprintsnpm warn deprecatedfor each one it installs.npm view inflight deprecatedshows the message for one package, and prints nothing if it isn't deprecated.npm explain inflightshows which of your dependencies brought it in.
npm outdated won't help: it only compares versions.