koajs/koa
Expressive middleware for node.js using ES2017 async functions
35.7k stars · 3.2k forks · JavaScript
Healthy
Healthy: actively maintained by 8 people, no known risks.
Why
No rule fired.
What would change this
- A dormant maintenance status, a deprecated or archived package, a successor link, or a critical advisory would change this.
Maintenance
CompleteActive
- Human commits, 30 days
- 2
- Human commits, 90 days
- 8
- Human commits, 365 days
- 31
- Bot share of commits, 365 days
- 33%
- Last commit
- Oct 9, 2026 (6 days ago)
- Last human commit
- Oct 9, 2026 (6 days ago)
- Authors, 90 days
- 8
- Last release
- May 21, 2026 (4 months ago)
- Median PR merge time
- 4 days
Responsiveness: of 0 recent issues, n/a got a maintainer reply. Median first response: n/a.
- Only 0 recent issues can be checked for a response, too few to measure response time.
Sources: Commits, Releases, Merged pull requests, Issues
People
Complete- Owner
- Organization
- Commits sampled
- 31 since Oct 14, 2025
- Authors for half of commits
- 4
- Authors for 80% of commits
- 12
- Contributors
- 236
Top committers
- fengmk2: 29% of commits
- yowainwright: 13% of commits
- Copilot: 6% of commits
- killagu: 6% of commits
- DucMinhNe: 3% of commits
Sources: Commits, Contributors
Stars
CompleteOrganic, confidence high
Bursts
- Nov 7, 2013 to Nov 7, 2013: about 10 more stars than usual, peak 10 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
- Dec 18, 2013 to Jan 10, 2014: about 1.8k more stars than usual, peak 798 in one day, a spike that tapers off. Outside explanation: a Hacker News post, a jump in forks.
- Jan 17, 2016 to Jan 22, 2016: about 191 more stars than usual, peak 70 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- 1 stars GitHub has since removed (tracked since Oct 14, 2026).
Anyone can buy stars for any repo; bursts alone don't prove the owner did.
- The star history looks organic.
Sources: How star history is analyzed
Risk
CompleteFlags
No risk flags.
License
- Now
- MIT (OSI-approved)
- A year ago
- MIT (OSI-approved)
Packages
- koa (NPM): latest 3.2.1, published May 21, 2026
Advisories for the latest version: none listed
Package and advisory data: deps.dev and OSV.
OpenSSF Scorecard: 5.5 out of 10 (via deps.dev).
Sources: GitHub: koajs/koa, deps.dev: npm koa
Badge
Add this to a README to show the current verdict:
[](https://reporadar.ai/koajs/koa)Earlier verdicts
- Oct 14, 2026: Healthy
- Oct 14, 2026: Healthy
- Oct 13, 2026: Healthy
Computed 13 hours ago · method 2026.10.2