KEVLAR-DEPRECATED-PACKAGE ● ERROR PRECISION: VERY-HIGH security deprecation end-of-life supply-chain

Deprecated or Abandoned Package Detected

Detected an installed dependency that has been officially flagged as deprecated, archived by authors, or reached End-of-Life (EOL). Continued usage exposes applications to unpatched CVEs and supply-chain account takeovers.

Overview Risk & Impact How Kevlar Detects It Remediation Guide Suppression & Policy

Overview

The KEVLAR-DEPRECATED-PACKAGE rule triggers when a package present in your direct or transitive dependency tree has been officially deprecated on its upstream public registry (NPM, PyPI, NuGet, Packagist, Go proxy), archived on GitHub, or designated End-of-Life (EOL) by maintainers.

Package deprecation is not merely a cosmetic warning. It indicates that the author or maintaining foundation has permanently halted feature development, bug fixes, and security patches. Widely used legacy packages (such as request in Node.js, pycrypto in Python, or Microsoft.Data.OData in .NET) have modern, secure successors that should be adopted immediately.

Permanent Zero-Day Vulnerability Window Because deprecated packages will never receive future patches, any newly discovered security vulnerability or remote code execution (RCE) flaw remains permanently unpatched on your systems. Attackers actively exploit known deprecation catalogs to target stagnant codebases.

Risk & Impact Analysis

Maintaining deprecated packages in your software supply chain presents acute operational and compliance liabilities:

● Supply Chain Hijacking

Abandoned packages frequently suffer maintainer account takeovers, expired domain hijacks, or deceptive ownership handoffs that inject infostealers and crypto miners into dependent applications.

● Permanent Unpatched Flaws

Vulnerabilities logged in the National Vulnerability Database (NVD) or Open Source Vulnerabilities (OSV) will never be remediated upstream. No maintainer is available to review security advisories.

● Cascading Runtime Breakage

Modern runtime engines deprecate unmaintained internal APIs (e.g. Node.js Buffer constructor, Python collections aliases), causing abandoned packages to trigger fatal runtime crashes.

● Regulatory Non-Compliance

PCI-DSS v4.0 (Req 6.3.2), SOC 2, HIPAA, and ISO 27001 explicitly mandate that third-party software components must be actively supported and maintained by upstream vendors.

How Kevlar Detects It

Kevlar CheckDeps performs automated deprecation audits against authoritative registry metadata endpoints without running package code:

1
Metadata Verification: Queries package registry metadata flags (e.g. NPM deprecated message field, PyPI Development Status :: 7 - Inactive trove classifier, NuGet package deprecation alternate metadata, Packagist abandoned flag).
2
Curated EOL Database Cross-Check: Cross-checks dependency names and version ranges against Kevlar's built-in catalog of superseded libraries and recommended replacements.
3
SARIF Emission: Generates an error level SARIF finding containing the exact author deprecation notice and suggested replacement libraries.

Example SARIF v2.1.0 result emitted by Kevlar:

sarif-report.json (v2.1.0)

{
  "ruleId": "KEVLAR-DEPRECATED-PACKAGE",
  "level": "error",
  "message": {
    "text": "Package '[email protected]' is deprecated: 'request has been deprecated, see https://github.com/request/request/issues/3142'. Recommended alternative: 'undici' or 'axios'."
  },
  "locations": [
    {
      "physicalLocation": {
        "artifactLocation": { "uri": "package.json" },
        "region": { "startLine": 24, "endLine": 24 }
      }
    }
  ],
  "properties": {
    "package": "request",
    "version": "2.88.2",
    "deprecationNotice": "request has been deprecated, see https://github.com/request/request/issues/3142",
    "suggestedReplacement": "undici",
    "precision": "very-high"
  }
}

Remediation Guide by Ecosystem

Replace deprecated dependencies with modern, actively maintained alternatives supported by current runtimes.

1. View official deprecation notice directly from the registry:

bash

npm view <package-name> deprecated

2. Common Node.js package migrations:

Deprecated Package	Recommended Replacement	Migration Path
`request`	`undici` / native `fetch()`	Fast HTTP client backed by Node core
`moment`	`date-fns` / `dayjs`	Lightweight, immutable, tree-shakeable
`babel-eslint`	`@babel/eslint-parser`	Official scoped Babel parser

3. Uninstall deprecated package and install replacement:

bash

npm uninstall request
npm install undici

1. Inspect package metadata and classifiers:

bash

pip show <package-name>

2. Common Python package migrations:

Deprecated Package	Recommended Replacement	Migration Path
`pycrypto`	`cryptography`	Modern authenticated primitives & OpenSSL bindings
`nose`	`pytest`	Standard active test runner in Python ecosystem
`python-memcached`	`pymemcache`	Pure-Python, thread-safe, actively maintained

3. Swap dependency in Poetry:

bash

poetry remove pycrypto
poetry add cryptography

1. Query all deprecated NuGet dependencies and check recommendations:

bash

dotnet list package --deprecated

2. Remove the deprecated package and install the recommended modern package:

bash

dotnet remove package <DeprecatedPackage>
dotnet add package <RecommendedPackage>

1. Audit your dependencies for abandoned or archived packages:

bash

composer audit --abandoned

2. Replace abandoned package with its community successor:

bash

composer remove abandoned/package
composer require modern/replacement-package

1. Inspect modules with deprecation notices in Go module proxy:

bash

go list -m -u all

2. Install the recommended replacement module and clean up go.mod:

bash

go get <replacement-module-path>@latest
go mod tidy

Suppression & Policy Configuration

When replacing a deprecated package requires substantial architectural redesign or API refactoring, engineering teams can configure a tracked migration waiver in kevlar-suppressions.json:

Mandatory Deprecation Sunset Plan Suppression entries for deprecated packages must cite an explicit retirement deadline (expiresAt) and assign a named engineering owner. Once the date passes, Kevlar breaks CI builds to guarantee migration completion.

kevlar-suppressions.json

{
  "version": "1.0",
  "suppressions": [
    {
      "ruleId": "KEVLAR-DEPRECATED-PACKAGE",
      "package": "request",
      "version": "2.88.2",
      "reason": "Legacy payment gateway client relies on request API hooks. Migration to undici scheduled for Q4 release.",
      "approvedBy": "[email protected]",
      "assignedOwner": "[email protected]",
      "expiresAt": "2026-12-15T00:00:00Z",
      "ticketUrl": "https://jira.company.internal/browse/PAY-3902"
    }
  ]
}