Is morgan healthy, maintained, and safe?

The verdict

morgan earns a health score of 70/100, a low risk rating, computed deterministically from live npm release history, maintainer data, and the OSV vulnerability database. No — morgan carries 1 unpatched critical advisory and should not be adopted without a remediation plan.

Its most recent release shipped on 2 June 2026 — 55 days ago — so development is clearly active. Across 28 releases the cadence has been steady, which is a good sign of an ongoing maintenance rhythm. 3 maintainers are listed on npm, so the project isn't hostage to any single contributor.

OSV lists 2 known advisories for morgan, including 1 critical. Open critical advisories are the strongest possible signal to pin to a patched version, replace, or fork before shipping. Each advisory is listed with its OSV/GHSA identifier below.

A couple of watch-items aside, morgan is a reasonable dependency to rely on; keep an eye on the flagged signals. This is a one-time snapshot of a single package — real projects depend on dozens or hundreds of packages, and any one of them can drift or be compromised between releases. Run your own package.json through the free health check, or have OSPulse monitor your whole dependency tree continuously.