When a library your business depends on goes quiet — archived by its owner, no release in years, issues piling up — OpenYuri takes custody of it in the open: a maintained fork, a named operator, and a ledger entry anyone can re-check. The ledger is free forever; these services are how the maintenance gets funded.
Entry point: three measured findings on one dependency — free. Paid diagnostic: USD 99 fixed.
Software today is assembled from hundreds of other people's projects, and every dependency is a bet that a stranger keeps showing up. Most do. Some stop — archiving the repository, leaving the last release years behind. Nothing breaks that day. That is what makes it dangerous: the package keeps installing, the code keeps running, and nobody notices that there is no longer anyone on the other end — until a vulnerability lands and there is no maintainer left to patch it.
AI sharpened this in both directions. Code has never been cheaper to write, so more projects are built on more dependencies than ever — while the humans maintaining those dependencies did not multiply. What is missing is not code. It is continuity and accountability: someone who shows up after the original author stops, and a record that proves they did.
This is not a theoretical service — the mechanism is already running. In June 2026 the author of jacktuck/unfurl archived it: a URL-scraping library still pulling roughly 144,000 npm downloads a month, last pushed in April 2024. Here is what custody looked like, done entirely on our own accounts and never writing to the upstream repository:
CUSTODY.md inside that copy naming who is responsible, how to report problems, and the fact that one sentence from the original author reverses the whole arrangement.@openyuri-labs/unfurl@6.4.0, delivered through our own package registry, clean-room install tested, with the tarball hash published (d0963468…) so the delivered bytes can be verified.If you depend on something drifting in the same direction, the services below apply this mechanism to your situation.
You send one project (a manifest or lockfile) and I check what it actually stands on: per dependency — owner-side activity signals, latest-release age, archive status, the open-issue backlog, and whether a maintained alternative exists. You get a written report where every quietly-dead dependency is listed with the exact measurement behind it and a command you can re-run yourself.
Fixed scope: one manifest, up to 200 dependencies, one clarification round.
The package you cannot drop. OpenYuri takes custody of it the way the example above shows: an open, accountable fork; a CUSTODY.md with a named operator and a reversal path; maintenance delivered through a registry channel you can install from; security-relevant issues reviewed and fixed when the fix is real and testable; and priority handling for reports from the subscribing client.
Fixes ship in the open and help every other user of the package. The ledger entry is public — so is the reversal path.
You are pinned to a version you cannot leave — a legacy platform, a vendored fork, a release your product is certified against. Instead of a forced upgrade, that version line is kept alive: critical fixes backported, each change accompanied by the test that demonstrates it, and a changelog stating exactly what changed and why.
Scope names the version line, the maximum review depth, and what counts as critical before anything is billed.
If your company depends on a package drifting toward abandonment, fund its upkeep. OpenYuri maintains it publicly, the ledger entry credits the sponsor, and the result stays free for everyone else building on it. It is the engagement where one invoice keeps the most strangers' builds green — and the sponsor gets the thing integrity usually doesn't come with: a public record of having paid for it.
If you maintain a project and want out, do not just archive it. Hand it to custody instead: a full-history public copy, a CUSTODY.md that keeps your name on the origin, users keep a release channel — and a single sentence from you reverses the whole arrangement at any time. No contracts, no lock-in; the exit door stays on your side.
The code that consumes your project is increasingly not human. This audit makes your package or site answerable to the machines that now read most of the web: structured metadata, an llms.txt, registry and answer-surface presence — and a re-runnable check of what an AI crawler or coding assistant can actually see and cite. Measured, not promised.
The form below and rescue@openyuri.com reach the same operator. Your message is read by the person who will do the work.
This form is relayed to my inbox by Web3Forms, a third-party form-to-email service. They receive your submission; I use it only to answer you. If you would rather not use a relay, email rescue@openyuri.com with the same four details: the dependency, the situation, your deadline, and how to reach you.
Start with the free step — three measured findings on one dependency, with the commands to re-check them. It costs nothing and shows you exactly how this work reads.