dead-deps — what happened to your dependencies

Is colors still maintained?

No — colors stopped being maintained around January 2022. @colors/colors is a community fork that picked colors up and carried it on.

Status
No longer maintained
Last maintained
January 2022
Use instead
@colors/colors on npm
Succession
Maintained fork
Drop-in
yes — swap the import
Confidence
medium

Is there a maintained fork of colors?

@colors/colors is a community fork that picked colors up and carried it on. @colors/colors is close enough to a drop-in replacement that most projects only change the dependency and the import.

How to migrate from colors to @colors/colors

@colors/colors is API-identical, so require('colors') becomes require('@colors/colors'). Moving to picocolors or chalk means rewriting 'text'.red as red('text').

Why colors is on this list

In January 2022 the 1.4.44-liberty-2 release of colors.js printed an endless stream of garbage characters, which broke builds across the ecosystem; 1.4.1 and 1.4.2 followed with the same behaviour, and npm pointed the latest tag back at 1.4.0, where it still sits. Nothing has been published since. @colors/colors is the same codebase republished under a scope by a colors.js maintainer and is what several downstream projects, including Winston, now depend on; its own last release was 1.6.0 in July 2023, so treat it as stable rather than actively developed. Many other projects took the opportunity to drop prototype patching entirely for chalk or picocolors.

The succession is well supported, but it is not the only defensible choice.

colors alternatives

Beyond the primary recommendation, these are credible for colors's use case:

Check your own project for colors

npx dead-deps --all --min-state unmaintained

Run that in the directory holding your lockfile. If colors is anywhere in your tree — a direct dependency or buried under something else — it appears in the report with this verdict, this successor and the same evidence links, alongside anything else that has stopped moving. Nothing is uploaded; the scan reads your lockfile locally and queries public registry metadata.

Exit code 1 means something was flagged, which makes npx dead-deps --min-state deprecated usable as a CI gate. See how verdicts are produced.

Evidence

Every claim on this page traces to a primary source. Check them:

See the full index of covered packages, or read the methodology for how a verdict is reached and why a quiet package is not a dead one.