Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,573
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
425 recordsRanked by popularity · browse by tag · record statistics
npm
26Criticalhealth index
browserify/events
Node's event emitter for all engines.
JavaScript★ 1,409Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
normalize/mz
modernize node.js to current ECMAScript standards
JavaScript★ 1,369↓ 259M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
28Criticalhealth index
php-http/discovery
Finds installed clients and message factories
PHP★ 1,324↓ 8.8M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
28Criticalhealth index
php-http/message
HTTP Message related tools
PHP★ 1,318↓ 4.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
42At riskhealth index
isaacs/node-graceful-fs
fs with incremental backoff on EMFILE
JavaScript★ 1,303↓ 753M/moJul 22, 2026
BlueOak-1.0.0Jul 22, 2026 · metrics 1.13.0
npm
30At riskhealth index
vercel/arg
Simple argument parsing
JavaScript★ 1,294↓ 451M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
26Criticalhealth index
Nyholm/psr7
A super lightweight PSR-7 implementation
PHP★ 1,276↓ 8.1M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
tim-kos/node-retry
Abstraction for exponential and custom retry strategies for failed operations.
JavaScript★ 1,258↓ 434M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
RubyGems
40At riskhealth index
email-spec/email-spec
Collection of RSpec/MiniTest matchers and Cucumber steps for testing email in a ruby app using ActionMailer or Pony
Ruby★ 1,191Jul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
npm
28Criticalhealth index
benjamn/ast-types
Esprima-compatible implementation of the Mozilla JS Parser API
TypeScript★ 1,172↓ 242M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
30At riskhealth index
moxystudio/node-cross-spawn
A cross platform solution to node's spawn and spawnSync
JavaScript★ 1,172↓ 970M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
52Moderatehealth index
php-http/client-common
Common HTTP Client implementations and tools for HTTPlug
PHP★ 1,050↓ 3.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
16Criticalhealth index
malware-dev/MDK-SE
Malware's Development Kit for SE
C#★ 1,044Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
26Criticalhealth index
dominictarr/rc
The non-configurable configuration loader for lazy people.
JavaScript★ 1,024↓ 167M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
RubyGems
66Moderatehealth index
net-ssh/net-ssh
Pure Ruby implementation of an SSH (protocol 2) client
Ruby★ 1,021Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
estools/estraverse
ECMAScript JS AST traversal functions
JavaScript★ 969↓ 849M/moJul 22, 2026
BSD-2-ClauseJul 22, 2026 · metrics 1.13.0
RubyGems
53Moderatehealth index
rack/rack-test
Rack::Test is a small, simple testing API for Rack apps.
Ruby★ 953Jul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
npm
29Criticalhealth index
tracespace/tracespace
⚡️generate beautiful and accurate SVG renders of printed circuit boards
TypeScript · PLSQL★ 945↓ 218K/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
RubyGems
48At riskhealth index
rails/jquery-rails
A gem to automate using jQuery with Rails
Ruby★ 943Jul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
npm
21Criticalhealth index
sindresorhus/object-assign
ES2015 Object.assign() ponyfill
JavaScript★ 918↓ 607M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
18Criticalhealth index
UniSecurityGuard/UniSecurityGuard
本科华五，曾赴美qs50读博，某兄弟院校副教授，校园门卫亭女性主理人，为防止炸号的备份平台，是本人。
Mixed★ 895Jul 21, 2026
No licenseJul 21, 2026 · metrics 1.13.0
npm
48At riskhealth index
estools/esquery
ECMAScript AST query library.
JavaScript★ 887↓ 523M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
35At riskhealth index
beatgammit/base64-js
Base64 encoding/decoding in pure JS
JavaScript★ 880↓ 475M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
38At riskhealth index
doug-martin/nestjs-query
Easy CRUD for GraphQL.
TypeScript★ 842↓ 111.2K/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
30At riskhealth index
xtuc/webassemblyjs
Toolchain for WebAssembly
JavaScript★ 834↓ 724M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
57Moderatehealth index
petersalomonsen/wasm-git
GIT for nodejs and the browser using https://libgit2.org compiled to WebAssembly with https://emscripten.org
JavaScript · C★ 833↓ 3,362/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
—
37At riskhealth index
rairprotocol/dev-dapp-season1
Learn how to deploy open-source Dapps while participating in our incentives program
Mixed★ 829Jul 21, 2026
GPL-3.0Jul 21, 2026 · metrics 1.13.0
npm · PyPI
60Moderatehealth index
invergent-ai/surogate
Training/Fine-tuning at the speed of light
C++ · Python · Cuda★ 806↓ 0/moJul 21, 2026
Apache-2.0Jul 21, 2026 · metrics 1.13.0
npm
27Criticalhealth index
mathiasbynens/jsesc
Given some data, jsesc returns the shortest possible stringified & ASCII-safe representation of that data.
JavaScript★ 796↓ 638M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
crates.io
32At riskhealth index
sourcegraph/sg.nvim
Experimental Sourcegraph + Cody plugin for Neovim
Lua · Rust★ 782Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0