Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

37,316

Monthly downloads under inspection

379B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

1,580 recordsRanked by popularity · browse by tag · record statistics

npm

31At riskhealth index

rvagg/through2

Tiny wrapper around Node streams2 Transform to avoid explicit subclassing noise

JavaScript★ 1,908↓ 189M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm · Packagist · RubyGems +1

49At riskhealth index

FGRibreau/mailchecker

:mailbox: Cross-language temporary (disposable/throwaway) email detection library. Covers 55 734+ fake email providers.

PHP · Rust · Elixir★ 1,898↓ 1.1M/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

Hex

43At riskhealth index

mochi/mochiweb

MochiWeb is an Erlang library for building lightweight HTTP servers.

Erlang★ 1,889↓ 163.3K/moJul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

npm

44At riskhealth index

feross/buffer

The buffer module from node.js, for the browser.

JavaScript★ 1,888↓ 575M/moJul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

PyPI

37At riskhealth index

pytest-dev/pytest-xdist

pytest plugin for distributed testing and loop-on-failures testing modes.

Python★ 1,876↓ 150M/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm

32At riskhealth index

hughsk/flat

:steam_locomotive: Flatten/unflatten nested Javascript objects

JavaScript★ 1,816↓ 121M/moJul 22, 2026

BSD-3-ClauseJul 22, 2026 · metrics 1.13.0

—

28Criticalhealth index

zhlynn/zsign

Fast Cross-Platform iOS Code Signing Tool

C++★ 1,813Jul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

47At riskhealth index

frenic/csstype

Strict TypeScript and Flow types for style based on MDN data

TypeScript★ 1,811↓ 590M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

PyPI

32At riskhealth index

cedricp/ddt4all

OBD tool

Python★ 1,779Jul 21, 2026

GPL-3.0Jul 21, 2026 · metrics 1.13.0

PyPI

37At riskhealth index

python/typing

Python static typing home. Hosts the documentation and a user help forum.

Python★ 1,764Jul 21, 2026

Custom licenseJul 21, 2026 · metrics 1.13.0

npm

15Criticalhealth index

WebDevStudios/Custom-Metaboxes-and-Fields-for-WordPress

Lets you easily create metaboxes with custom fields that will blow your mind.

PHP · CSS · JavaScript★ 1,737↓ 89/moJul 22, 2026

No licenseJul 22, 2026 · metrics 1.13.0

npm

22Criticalhealth index

alexeyraspopov/picocolors

The tiniest and the fastest library for terminal output formatting with ANSI colors

JavaScript★ 1,736↓ 835M/moJul 22, 2026

ISCJul 22, 2026 · metrics 1.13.0

Packagist

23Criticalhealth index

symfony/polyfill-php80

Symfony polyfill backporting some PHP 8.0+ features to lower PHP versions

PHP★ 1,726↓ 17.6M/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

—

32At riskhealth index

zzzprojects/System.Linq.Dynamic.Core

The .NET Standard / .NET Core version from the System Linq Dynamic functionality.

C#★ 1,708Jul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

RubyGems

32At riskhealth index

Dirkster99/AvalonDock

Our own development branch of the well known WPF document docking library

C#★ 1,705Jul 21, 2026

MS-PLJul 21, 2026 · metrics 1.13.0

npm

29Criticalhealth index

lukeed/kleur

The fastest Node.js library for formatting terminal text with ANSI colors~!

JavaScript · Shell★ 1,696↓ 316M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

28Criticalhealth index

mathiasbynens/punycode.js

A robust Punycode converter that fully complies to RFC 3492 and RFC 5891.

JavaScript★ 1,687↓ 786M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

—

12Criticalhealth index

bezzad/Downloader

Fast, cross-platform and reliable multipart downloader with asynchronous progress events for .NET applications.

C#★ 1,685Jul 17, 2026

MITJul 17, 2026 · metrics 1.13.0

PyPI

49At riskhealth index

atlassian-api/atlassian-python-api

Atlassian Python REST API wrapper. The atlassian-python-api library provides a simple and convenient way to interact with Atlassian products (such as Jira Service management, Jira Software, Confluence, Bitbucket and apps Insight, X-Ray) using Python. It is based on the official REST APIs of these products and by community for Atlassian

Python★ 1,663↓ 15.6M/moJul 21, 2026

Apache-2.0Jul 21, 2026 · metrics 1.13.0

PyPI

34At riskhealth index

rushter/selectolax

Python binding to Modest and Lexbor engines. Fast HTML5 parser with CSS selectors for Python.

Cython · Python★ 1,656Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm