Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,579
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
426 recordsRanked by popularity · browse by tag · record statistics
npm
25Criticalhealth index
browserify/randombytes
random bytes from browserify stand alone
JavaScript★ 102↓ 145M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
28Criticalhealth index
brianloveswords/buffer-crc32
A pure javascript CRC32 algorithm that plays nice with binary data
JavaScript★ 100↓ 261M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
25Criticalhealth index
Nyholm/psr7-server
Helper classes to use any PSR7 implementation as your main request and response
PHP★ 96↓ 2.3M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
37At riskhealth index
sindresorhus/has-flag
Check if argv has a specific flag
JavaScript · TypeScript★ 96↓ 1.1B/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
14Criticalhealth index
loganfsmyth/gensync
Allows users to use generators in order to write common functions that can be both sync or async.
JavaScript★ 95↓ 495M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
19Criticalhealth index
mpfast/TaroCreator
微信小程序 小程序模板 小程序可视化设计工具 Taro Taro UI
Vue · SCSS★ 94Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
RubyGems
44At riskhealth index
jekyll/jekyll-avatar
A Jekyll plugin for rendering GitHub avatars
Ruby★ 92Jul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
15Criticalhealth index
blakeembrey/array-flatten
Flatten a multi-dimensional array in JavaScript.
JavaScript · TypeScript★ 86↓ 221M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
34At riskhealth index
gkz/levn
Light ECMAScript (JavaScript) Value Notation - human written, concise, typed, flexible
LiveScript★ 85↓ 535M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
19Criticalhealth index
lddubeau/saxes
An evented streaming XML parser in JavaScript
TypeScript★ 84Jul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
25Criticalhealth index
gulpjs/glob-parent
Extract the non-magic parent path from a glob string.
JavaScript★ 83↓ 1.3B/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
NuGet
16Criticalhealth index
Chatham/Vault.NET
.NET API client for vault
C#★ 80Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
37At riskhealth index
estools/esrecurse
AST recursive visitor
JavaScript★ 80↓ 539M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
20Criticalhealth index
microsoft/p-graph
Moved to https://github.com/microsoft/beachball/tree/main/packages/p-graph
TypeScript★ 79↓ 120.1K/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
NuGet
31At riskhealth index
erri120/GameFinder
.NET library for finding games.
C#★ 78Jul 24, 2026
GPL-3.0Jul 24, 2026 · metrics 1.13.0
npm
38At riskhealth index
sindresorhus/array-union
Create an array of unique values, in order, from the input arrays
TypeScript · JavaScript★ 78↓ 252M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
15Criticalhealth index
isaacs/inflight-DEPRECATED-DO-NOT-USE
Add callbacks to requests in flight to avoid async duplication
Mixed★ 76Jul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
39At riskhealth index
sindresorhus/node-defaults
Easily handle defaults for your options
JavaScript · TypeScript★ 76↓ 198M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
29Criticalhealth index
probots-io/pinecone-php
A beautiful, extendable PHP Package to communicate with your pinecone.io indices, collections and vectors.
PHP★ 75↓ 13.4K/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
PyPI
14Criticalhealth index
rohe/pyoidc
A complete OpenID Connect implementation in Python
Python★ 71Jul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
25Criticalhealth index
JsCommunity/make-error
Make your own error types!
JavaScript★ 70↓ 198M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
Packagist
22Criticalhealth index
miladrahimi/php-jwt
A PHP implementation of JWT (JSON Web Token) generator, parser, verifier, and validator.
PHP★ 70↓ 4,343/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
20Criticalhealth index
didilinkin/elf-taro
Taro 小程序 脚手架 (Taro 3 + Dva + Typescript + Immer) - 内置 Redux 计数器, 异步数据请求 与 腾讯小程序地图 demo
TypeScript · JavaScript★ 69Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
Go
31At riskhealth index
otterize/credentials-operator
Automatically register and generate AWS, GCP & Azure IAM roles, X.509 certificates and username/password pairs for Kubernetes pods using cert-manager, CNCF SPIRE or Otterize Cloud
Go★ 68Jul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0
npm
19Criticalhealth index
fjc0k/mounted
基于 Taro 的小程序组件库。
TypeScript · CSS★ 67↓ 153/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
40At riskhealth index
sindresorhus/merge-streams
Merge multiple streams into a unified stream
JavaScript★ 65↓ 127M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
31At riskhealth index
Placekey/placekey-py
No repository description published.
Python★ 64↓ 87.4K/moJul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0
npm
18Criticalhealth index
peterszombati/xapi-node
xStation5 Trading API for NodeJS/JS
TypeScript★ 63↓ 2,293/moJul 24, 2026
Custom licenseJul 24, 2026 · metrics 1.13.0