You said it yourself, this is a very hard problem.

There are Java packages that haven't seen a commit in years and are still perfect for a task. There are npm packages that are 2 months old and terribly outdated and unmaintained.

My personal favorite metric is "time to maintainer response": how long does it take for a maintainer to respond to issues or pull requests. Not necessarily to resolve them, but triage issues or provide guidance on a PR.

If this happens quickly and with reasonable responses, projects are usually solid, assuming they have existed for a while and see decent usage.