Interesting idea, but it doesn't seem to work as I expected. E.g. plugging in "leaflet" package I do not get other map display libs, only some mostly unrelated plugins.
With updating old packages popularity and download count might be not best metrics, as some less popular or rarely updated projects might be still usable. Security should play important role in suggestions, especially finding insecure packages in provided package.json list, and providing alternatives that should be easy to replace - introducing some new packages might result in whole day of work to get it working with all parts of project.