dead-deps — what happened to your dependencies

Is csurf still maintained?

No — csurf stopped being maintained around January 2020. The ecosystem moved to csrf-csrf, a separate project that took over the same job.

Status
No longer maintained
Last maintained
January 2020
Use instead
csrf-csrf — on npm
Succession
Replacement project
Drop-in
no — expect code changes
Confidence
medium

What should I use instead of csurf?

The ecosystem moved to csrf-csrf, a separate project that took over the same job. csrf-csrf is not a drop-in replacement, so expect to change call sites.

How to migrate from csurf to csrf-csrf

csrf-csrf is configured through doubleCsrf({getSecret, cookieName}), which returns the middleware and a token generator; the template-side call changes from req.csrfToken() to the generator returned by that factory.

Why csurf is on this list

csurf was the standard Express CSRF middleware; its last release was 1.11.0 in January 2020, and the Express team archived the repository on 14 May 2025 with an npm notice saying the package is archived and no longer maintained. No official replacement was named. csrf-csrf, which implements the double-submit cookie pattern, is the most widely installed of the actively maintained options, and @dr.pogodin/csurf is a maintained fork if you need the original API.

The succession is well supported, but it is not the only defensible choice.

csurf alternatives

Beyond the primary recommendation, these are credible for csurf's use case:

Check your own project for csurf

npx dead-deps --all --min-state unmaintained

Run that in the directory holding your lockfile. If csurf is anywhere in your tree — a direct dependency or buried under something else — it appears in the report with this verdict, this successor and the same evidence links, alongside anything else that has stopped moving. Nothing is uploaded; the scan reads your lockfile locally and queries public registry metadata.

Exit code 1 means something was flagged, which makes npx dead-deps --min-state deprecated usable as a CI gate. See how verdicts are produced.

Evidence

Every claim on this page traces to a primary source. Check them:

See the full index of covered packages, or read the methodology for how a verdict is reached and why a quiet package is not a dead one.