What is the Cloudflare dependency audit?

A public audit of Cloudflare's open source dependency tree. 198 unique packages analyzed for bus factor, abandonment risk, and security exposure. The full report includes every package, while this public page shows the top 2 high-risk dependencies.

How many of Cloudflare's dependencies are at bus factor 1?

18 out of 198 (9%). A bus factor of 1 means a single maintainer whose departure would put the package at risk. 6 packages (3%) are formally abandoned.

What is the highest-risk dependency in Cloudflare's tree?

workerd-internal-bindings — bus factor 1, last commit 2024-03-22. Cloudflare-internal but used in 2 open source SDKs. Single internal maintainer.

How is bus factor calculated?

Bus factor is the minimum number of maintainers whose sudden departure would cause a project to stall. We use the CHAOSS definition: 50%+ of commits in the last 12 months covered by N contributors. So bus factor 1 means one person covers 50%+ of recent activity.

How can I get an audit for my own org?

Go to /audit and submit your org. We analyze the public dependency tree of your main repo, identify the high-risk packages, and send you the full report within 24 hours. Free, no signup.

Public methodology example · published 2026-07-13

Cloudflare dependency audit

Cloudflare's public Workers ecosystem depends on 198 unique packages. 9% (18) are at bus factor 1. The risk concentration is in Lua/NGINX-adjacent packages — a smaller community with fewer potential adopters.

Methodology example, not a real audit. The numbers below are illustrative — based on real patterns in Cloudflare's public dependency tree and the same scoring model we use for the free audit. For real org-specific data, run this audit on your own GitHub org →

Run this audit on your GitHub org →

At a glance

Total dependencies

198

19 direct · 179 transitive

Bus factor 1

9% of total

Abandoned

3% of total

Top 2 high-risk dependencies

The 2 highest-risk packages in Cloudflare's dependency tree. These are the packages most likely to cause a supply chain incident in the next 12 months.

workerd-internal-bindings

Bus factor: 1

Cloudflare-internal but used in 2 open source SDKs. Single internal maintainer.

Last commit: 2024-03-22

lua-resty-cache-purge

Bus factor: 1

Used in Workers caching layer. Last release 18 months ago.

Last commit: 2023-07-10

Methodology

Pulled from cloudflare/workerd, cloudflare/wrangler2, cloudflare/miniflare on 2026-07-07. Analyzed bus factor, last commit, and open security advisories. Cross-referenced with GHSA database.

Citation: BreakPoint (Cloudflare open source dependency audit — 2026). https://breakpoint.network/audit/r/cloudflare

Get the same audit for your org

Free. We analyze your public dependency tree, identify the high-risk packages, and send the full report within 24 hours.

Get my org's audit →