Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

37,507

Monthly downloads under inspection

379B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

1,592 recordsRanked by popularity · browse by tag · record statistics

28Criticalhealth index

goreflect/go_structor

Go configurator structures library

Go★ 12Jul 19, 2026

MITJul 19, 2026 · metrics 1.13.0

29Criticalhealth index

goreflect/gostructor

Go configurator structures library

Go★ 12Jul 19, 2026

MITJul 19, 2026 · metrics 1.13.0

Packagist

42At riskhealth index

marineusde/larapex-charts

A Laravel wrapper for apex charts

PHP★ 12↓ 3,491/moJul 24, 2026

MITJul 24, 2026 · metrics 1.13.0

—

15Criticalhealth index

rsyslog/libestr

OFFICIAL libestr repository on github

C★ 12Jul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

npm

33At riskhealth index

wooorm/bail

Throw if given an error

JavaScript · TypeScript★ 12↓ 169M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

15Criticalhealth index

CycloneDX/cdxgen-action

GitHub action for CycloneDX BOM generator (cdxgen). cdxgen produced bom xml file can be uploaded to dependency track, AppThreat and other commercial Software Composition Analysis (SCA) products

JavaScript★ 11Jul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Maven

11Criticalhealth index

appKODE/build-publish-plugin

Gradle plugin for Android that automates build publishing: consistent artifact naming + changelog/release notes generation, and variant-aware uploads to Firebase App Distribution, Confluence, Telegram, Slack and more

Kotlin★ 11Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

Packagist

30At riskhealth index

composer-unused/contracts

Contract repository for composer-unused

PHP★ 11↓ 380.9K/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Packagist · npm

20Criticalhealth index

dnwjn/nova-button

A Nova package for rendering buttons on different views.

PHP · Vue★ 11↓ 4,838/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

RubyGems

21Criticalhealth index

excpt/moments

Handles time differences and calculations.

Ruby★ 11Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

Packagist

36At riskhealth index

laminas/laminas-psr7bridge

PSR-7 <-> laminas-http message conversions

PHP★ 11↓ 67.5K/moJul 24, 2026

BSD-3-ClauseJul 24, 2026 · metrics 1.13.0

npm

10Criticalhealth index

mazixs/n8n-node-converter-documents

n8n community node that converts various document formats into structured JSON or text for AI agents and workflows.

TypeScript · Rich Text Format · HTML★ 11↓ 8,516/moJul 19, 2026

MITJul 19, 2026 · metrics 1.13.0

npm

32At riskhealth index

reportportal/agent-js-webdriverio

Agent to integrate Webdriver.io with ReportPortal.

TypeScript★ 11↓ 12.4K/moJul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

Packagist

38At riskhealth index

roadrunner-php/kv

:electric_plug: RoadRunner Key-Value storage SDK

PHP★ 11↓ 271.1K/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

32At riskhealth index

shikijs/vscode-textmate

Shiki's fork of `vscode-textmate`

TypeScript★ 11↓ 61.5M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

31At riskhealth index

unshiftio/requires-port

Check if a protocol requires a certain port number to be added to an URL.

JavaScript★ 11↓ 191M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

31At riskhealth index

wooorm/comma-separated-tokens

Parse and stringify comma-separated tokens

JavaScript★ 11↓ 176M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Packagist

29Criticalhealth index

yiisoft/input-http

Provides Yii Hydrator attributes to get data from PSR-7 HTTP request and adds extra abilities to middlewares processed by Yii Middleware Dispatcher.

PHP★ 11↓ 9,001/moJul 20, 2026

BSD-3-ClauseJul 20, 2026 · metrics 1.13.0

Packagist

26Criticalhealth index

Automattic/jetpack-changelogger

[READ ONLY] Allows for managing changelogs by dropping change files into a changelog directory with each PR. This repository is a mirror, for issue tracking and development head to: https://github.com/automattic/jetpack

PHP★ 10↓ 186.1K/moJul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

Packagist

24Criticalhealth index

Automattic/jetpack-device-detection

[READ ONLY] A method to detect device types, originates from `jetpack_is_mobile`. This repository is a mirror, for issue tracking and development head to: https://github.com/automattic/jetpack

PHP★ 10↓ 38.4K/moJul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0