Fossil versions: a fingerprint of AI-written code in 250k NPM packages (github.com)

A recent analysis of 250,000 npm packages has uncovered a significant rise in the prevalence of "fingerprints" indicative of AI-generated code, specifically in the form of outdated dependency versions. Between 2021 and early 2024, only 1% to 2.4% of newly released packages featured these stale round version numbers; however, by the first half of 2026, this figure surged to 13.7%. This trend suggests that many new packages are being created with dependencies that are significantly out-of-date, raising concerns about the freshness and security of software ecosystems. The implications are critical for the AI/ML community and software development at large, as they hint at an increasing reliance on AI models to generate dependency manifests without real-time updates. The findings indicate that the typical age of dependency pins at package inception has escalated from around 155 days to approximately 451 days by mid-2026. Moreover, only about 10% of new packages in 2026 utilized the most current versions, down from 28% in previous years. These trends not only reflect a potential decline in software quality but also pose risks regarding security vulnerabilities introduced by outdated dependencies, highlighting the need for better awareness and tools for both developers and AI systems in managing package dependencies.