There are unofficial stability badges[0] that I have seen some packages use. For example, xtend[1] is locked.

[0]: https://github.com/badges/stability-badges

[1]: https://www.npmjs.com/package/xtend