Interesting idea, but it doesn't seem to work as I expected. E.g. plugging in "leaflet" package I do not get other map display libs, only some mostly unrelated plugins.
With updating old packages popularity and download count might be not best metrics, as some less popular or rarely updated projects might be still usable. Security should play important role in suggestions, especially finding insecure packages in provided package.json list, and providing alternatives that should be easy to replace - introducing some new packages might result in whole day of work to get it working with all parts of project.
Awesome feedback!
I liked especially the suggestion about displaying easy-to-replace packages, as Similar, to vulnerable packages currently used.
I'm reworking the package similarity matcher to provide better results, and I'll take all your suggestions into account.
Thanks!
