left-pad (npm): Dependency Health Check, Avoid for New Code / Keep but Plan Exit for Existing

Bottom line

Verdict: Avoid for new code; for existing code, Keep but plan exit. left-pad is frozen, deprecated and replaceable by a built-in. Its latest version, 1.3.0, was published on 2018-04-09, every version carries the npm deprecation notice "use String.prototype.padStart()", and the GitHub repository was archived on 9 May 2019. The code has no known advisories, so the risk is abandonment and licence ambiguity, not an active vulnerability. Usage is still huge: 4,139,138 downloads in the week of 2026-09-28 to 2026-10-04, almost all of it presumably transitive (inference). Native String.prototype.padStart() has been available across browsers since April 2017, so a direct dependency can be removed at low cost.

Identity resolved: the npm package left-pad (unscoped), whose registry entry points to github.com/stevemao/left-pad, now hosted at github.com/left-pad/left-pad (an organisation-owned, archived repo, which looks like a transfer; inference). The npm entry lists two maintainers, stevemao and westlac. Lookalike names exist and are malicious (see Security). All data was retrieved on 2026-10-05.

Snapshot

Maintenance: no releases since 2018 and the repository is read-only

Release cadence. The registry shows 15 versions, from 0.0.0 on 2014-03-14 to 1.3.0 on 2018-04-09. That is zero releases in the last 12 and 24 months, and a gap of about 8.5 years to today. Before the freeze the longest gap was from 1.1.3 (2016-10-01) to 1.2.0 (2017-11-17), about 13.5 months. No version is marked yanked in the registry document, and no pre-releases appear. I did not check endoflife.date; the project is unlikely to be listed (unverified).

Bus factor. The contributors API lists 16 contributors; stevemao has 30 contributions, and the other 15 have between 1 and 7 each. By my own sum the total is 59, so one person made roughly half of all commits. The last push was 2019-04-19, so commits in the last 12 months: none. I found no governance file, foundation or funding link in the repository file list (root listing), and no evidence on whether maintainers are company-paid. The repository description itself says "deprecated, use String.prototype.padStart()". Bus factor is effectively zero: nobody is maintaining it, by design.

KEY TAKEAWAY: Maintenance is over, and the registry deprecation notice, the repo description and the archive flag all point the same way.

Issues trend: frozen at 3 open issues and 7 open pull requests

The GitHub API reports 10 open items, and the repo page shows 3 issues and 7 pull requests. From the issue listing, the open issues are #43 (opened 2017-07-27, a TypeError report), #48 (2017-10-21) and #67 (2019-04-19). The oldest open issue is about 9 years old. Open pull requests include a proposal to use the native padStart where available (#57, 2018-02-28) that was never merged. Because the repo is archived, new issues cannot be filed and response time is not meaningful. The open count has been flat since the 2019 archive (inference from the last-activity dates). I did not measure first-response times.

Security history: no advisories, but no modern supply-chain controls

Practices. The root file listing shows no SECURITY.md, and deps.dev shows no provenance. npm registry signatures exist on each version, which only proves registry integrity. I did not retrieve an OpenSSF Scorecard or an NVD result, so those are open items.

Historical incident. On 22 March 2016, author Azer Koçulu unpublished 273 packages, including left-pad, after a name dispute over "kik". npm reported hundreds of failures per minute and a disruption of 2.5 hours. Cameron Westland published a functionally identical version as 1.0.0 within ten minutes, and npm restored the original 0.0.3. npm then said it would make it harder to unpublish a version if that would break other packages. This was an availability incident, not a malicious release. It explains the registry's odd version history: 0.0.3 and 0.0.9 share one timestamp, and early versions list different repos and maintainers.

Typosquat warning (inference). Two OSV malware entries use "left-pad" in their names. Pin the exact name left-pad and review lockfile diffs.

Licence: the published package and the repository disagree

• npm metadata: the registry top-level license is WTFPL, version 1.3.0 is WTFPL in deps.dev, and versions 0.0.0, 0.0.1, 0.0.2 and 0.0.4 list BSD.
• Repository: the master LICENSE is MIT, "Copyright (c) 2018 Steve Mao", and master package.json also says MIT. GitHub's API maps it to SPDX MIT.
• History: issue #51, "License clarification for older versions" (2017-11-14), PR #61 "Replacing WTFPL with MIT License" (closed 2018-11-23) and PR #62 (January 2019) show the relicensing. It happened after the last npm publish in April 2018, which is consistent with the registry still saying WTFPL (inference). I did not open the published tarball's LICENSE, and I found no CLA and did not use ClearlyDefined.

Both licences are permissive, so risk is low, but a scanner will report a different SPDX ID depending on whether it reads the registry (WTFPL) or the repo (MIT). If you distribute in a commercial product, have counsel review which licence governs the version you ship. This is not legal advice.

Breaking-change history: one major, no changelog

The history has 0.0.x versions (2014 to 2016) then 1.0.0 on 2016-03-22. 1.0.0 was the republish after the unpublish incident, so the only "major" was an emergency, not a planned API break. After that there are only 1.x minors and patches, and the final features were TypeScript types in 1.2.0. The repository file list has no CHANGELOG. The README warns that a multi-character pad argument is not rejected and that characters outside the BMP count as two, which differs from native padStart behaviour in some edge cases (inference; test before swapping).

Alternatives: the built-in is the right replacement

Recommendation. Replace leftPad(x, n, c) with String(x).padStart(n, c). Use the string.prototype.padstart shim only if you must support engines without it. Avoid lodash.padstart and pad-left: they are as old as left-pad. For transitive uses, run npm ls left-pad and upgrade or override the parent packages; the 19,155 dependents mean many projects will still pull it in.

Risks and open questions

• Not verified: NVD search, OpenSSF Scorecard, ClearlyDefined, endoflife.date, SECURITY.md contents, tarball LICENSE, first-response times, and whether maintainers are employed by a company.
• Advisory coverage: OSV was checked through a name search page only, not the package-query API (it returned HTTP 405 on a plain fetch).
• Alternatives depth: advisory status for alternatives rests on deps.dev's per-version list, not a full database sweep.
• Download composition: the split between direct and transitive downloads is not available; the claim that most are transitive is an inference from 576 direct versus 18,595 indirect dependents.
• What would change the verdict: a confirmed advisory, or a maintained fork under a clear licence, would move the guidance; neither was found.

Sources

Retrieved 2026-10-05 unless noted.

• npm registry document for left-pad
• npm downloads API, left-pad, last week
• deps.dev version record, left-pad 1.3.0
• deps.dev dependents count, left-pad 1.3.0
• GitHub API, left-pad/left-pad repository
• GitHub repository page, left-pad/left-pad
• GitHub API, contributors
• GitHub API, issues and pull requests
• Repository LICENSE file (master)
• Repository package.json (master)
• GitHub Advisory Database query, npm left-pad
• OSV list search, left-pad (npm)
• OSV MAL-2025-844 (left-pad-browser)
• OSV MAL-2022-4567 (meta-left-pad)
• npm blog post-mortem: kik, left-pad, and npm (23 March 2016)
• MDN: String.prototype.padStart()
• npm registry, string.prototype.padstart latest
• deps.dev, string.prototype.padstart 3.1.7
• npm downloads API, string.prototype.padstart
• npm registry, lodash.padstart latest
• deps.dev, lodash.padstart 4.6.1
• npm downloads API, lodash.padstart
• npm downloads API, lodash
• npm registry, pad-left latest
• deps.dev, pad-left 2.1.0
• npm downloads API, pad-left