Return a cross-validated fitness verdict for an npm package: is it deprecated / yanked / superseded / malicious, and if so what is the safe migration target. Unlike a plain 'is it deprecated' lookup, this reconciles the npm registry, deps.dev, OSV and GitHub into one confidence-scored answer, infers a safe replacement when one exists, and flags disagreement instead of guessing. Also detects non-existent / hallucinated package names.

Audit many npm dependencies at once and return a per-package fitness verdict plus a summary (how many are deprecated / malicious / vulnerable / behind). Accepts a list of package specs (e.g. ['react@18.2.0', 'request']) and/or the raw contents of a package.json. Ideal for a CI / pre-merge dependency gate. Capped at 50 packages per call.