···2121 }
2222 metadata?: {
2323 license?: string
2424+ /**
2525+ * Publish date of this version (ISO 8601 date-time string).
2626+ * Uses `time[version]` from the registry, NOT `time.modified`.
2727+ * For example, if the package was most recently published 3 years ago
2828+ * but a maintainer was removed last week, this would show the '3 years ago' time.
2929+ */
2430 lastUpdated?: string
2531 engines?: { node?: string; npm?: string }
2632 deprecated?: string
···133139 },
134140 metadata: {
135141 license: pkgData.license,
136136- lastUpdated: pkgData.time?.modified,
142142+ // Use version-specific publish time, NOT time.modified (which can be
143143+ // updated by metadata changes like maintainer additions)
144144+ lastUpdated: pkgData.time?.[latestVersion],
137145 engines: analysis?.engines,
138146 deprecated: versionData?.deprecated,
139147 },
···4747 'name': string
4848 'description'?: string
4949 'dist-tags': { latest?: string } & Record<string, string>
5050- /** Only includes time for dist-tag versions + modified/created */
5050+ /**
5151+ * Timestamps for package versions.
5252+ *
5353+ * **IMPORTANT**: Use `time[version]` to get the publish date of a specific version.
5454+ *
5555+ * **DO NOT use `time.modified`** - it can be updated by metadata changes (e.g., maintainer
5656+ * additions/removals) without any code being published, making it misleading for users
5757+ * trying to assess package maintenance activity.
5858+ *
5959+ * - `time[version]` - When that specific version was published (use this!)
6060+ * - `time.created` - When the package was first created
6161+ * - `time.modified` - Last metadata change (misleading - avoid using)
6262+ */
5163 'time': { modified?: string; created?: string } & Record<string, string>
5264 'maintainers'?: NpmPerson[]
5365 'author'?: NpmPerson