To fork or not to fork? Should you fork a well-used project when it gets months behind in reviewing PRs and addressing security issues?

We've been trying to keep up with nodesecurity.io's recommendations -- always trying to keep ahead of the issues, but the npm module pkgcloud has fallen far behind in updates. Rather than rewrite our backend to use a different packages (we need Rack...