What is a maintainer takeover?
Updated
A maintainer takeover is when control of a package passes to a new, often unvetted account, which then changes what the package does in a later release.
Quotable facts
As of 2026-10-07
- A takeover changes who publishes a package, not its name (definition, 2026-10-07).
- Crowsnest flags a change in who maintains a package, and ranks maintainers by risk in the Lookout page (dashboard, 2026-10-07).
- Lookout shows risk from 0 (low) to 1 (high) and activity over the last 90 days (dashboard guide, 2026-10-07).
Why does it matter?
You trusted the package because of who ran it. When that changes, a package you have used for years can change quietly.
How do I stay safe?
- Commit your lockfile so updates are visible.
- Read the changes when a package you depend on updates after a long quiet spell.
- Be careful with packages that are widely used but have not been updated for a long time.
- Scan regularly. Crowsnest flags a change in who maintains a package.
What this does not do
This page defines the term. A new maintainer is not always an attacker. Packages change hands for good reasons, so a flag is a prompt to look, not a verdict.
Where do I read more?
Related terms: supply chain attack and lockfile. Read What to do when Crowsnest says Hold, or see the Lookout page in Using the dashboard. Back to the glossary.
Related
- Supply chain attackA supply chain attack is when an attacker harms you by tampering with something you rely on, such as a software package, instead of attacking you directly.
- LockfileA lockfile is a file, such as package-lock.json, that records the exact version of every package your project installed, including the packages your packages depend on.
- What to do when Crowsnest says Hold.A calm, step-by-step way to read the call and take the first step.
- Using the dashboardRead a Crowsnest call in the dashboard: what happened, how serious it is and what to do. A guide to Horizon, Lookout, Hold and Log, plus shortcuts.