Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,169
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Clear filters
404 recordsRanked by popularity · browse by tag · record statistics
npm
33At riskhealth index
micromatch/is-extglob
Returns true if a string has an extglob
JavaScript★ 23Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
39At riskhealth index
jsdom/w3c-xmlserializer
An XML serializer that follows the W3C specification.
JavaScript★ 22↓ 281M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
hughsk/is-typedarray
Detect whether or not an object is a Typed Array
JavaScript★ 21↓ 138M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
16Criticalhealth index
EVerest/libslac
Simple ISO15118-3 SLAC implementation
C++★ 19Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
npm
33At riskhealth index
wooorm/zwitch
Handle values based on a property
JavaScript · TypeScript★ 17↓ 175M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
cspotcode/node-source-map-support
Adds source map support to node.js (for stack traces)
JavaScript★ 16↓ 189M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
20Criticalhealth index
WalletConnect/auth-client-js
No repository description published.
TypeScript★ 15↓ 52.1K/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
StenaIT/stenajs-webui
A collection of React components and hooks
TypeScript★ 14↓ 31K/moJul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
11Criticalhealth index
defunctzombie/node-stackback
return array of v8 CallSite objects for a stacktrace
JavaScript★ 14Jul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
22Criticalhealth index
flipperdevices/stm32wb_copro
No repository description published.
C++ · C★ 14Jul 23, 2026
No licenseJul 23, 2026 · metrics 1.13.0
npm
27Criticalhealth index
samn/json-stable-stringify
deterministic JSON.stringify() with custom sorting to get deterministic hashes from stringified results
JavaScript★ 13↓ 508M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
PyPI
22Criticalhealth index
astronomer/astro-airflow-mcp
MCP server for Apache Airflow instances. Runs standalone or as an Airflow plugin.
Python★ 12Jul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0
Packagist
42At riskhealth index
marineusde/larapex-charts
A Laravel wrapper for apex charts
PHP★ 12↓ 3,491/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
33At riskhealth index
wooorm/bail
Throw if given an error
JavaScript · TypeScript★ 12↓ 169M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
15Criticalhealth index
CycloneDX/cdxgen-action
GitHub action for CycloneDX BOM generator (cdxgen). cdxgen produced bom xml file can be uploaded to dependency track, AppThreat and other commercial Software Composition Analysis (SCA) products
JavaScript★ 11Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
30At riskhealth index
composer-unused/contracts
Contract repository for composer-unused
PHP★ 11↓ 380.9K/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
32At riskhealth index
shikijs/vscode-textmate
Shiki's fork of `vscode-textmate`
TypeScript★ 11↓ 61.5M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
31At riskhealth index
unshiftio/requires-port
Check if a protocol requires a certain port number to be added to an URL.
JavaScript★ 11↓ 191M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
31At riskhealth index
wooorm/comma-separated-tokens
Parse and stringify comma-separated tokens
JavaScript★ 11↓ 176M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
34At riskhealth index
STARRY-S/zip
Go zip library with Append (Updater) support.
Go★ 10Jul 23, 2026
BSD-3-ClauseJul 23, 2026 · metrics 1.13.0
npm
38At riskhealth index
isaacs/package-json-from-dist
No repository description published.
TypeScript★ 10↓ 387M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
RubyGems
33At riskhealth index
kontena/kontena-loadbalancer
Kontena Load Balancer
Ruby · Shell★ 10Jul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0
npm
34At riskhealth index
wooorm/space-separated-tokens
Parse and stringify space-separated tokens
JavaScript★ 10↓ 172M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
VdustR/hanamin
A webfont repository for Hanamin
CSS★ 9↓ 365/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
19Criticalhealth index
radxa/mraa
Linux Library for low speed IO Communication in C with bindings for C++, Python, Node.js & Java. Supports generic io platforms, as well as Intel Edison, Intel Joule, Raspberry Pi and many more.
C★ 9Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
23Criticalhealth index
wooorm/character-entities
Map of named character references.
JavaScript★ 9↓ 197M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
31At riskhealth index
wooorm/longest-streak
Count the longest repeating streak of a substring
JavaScript★ 9↓ 164M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
crates.io
27Criticalhealth index
CreepySkeleton/proc-macro-error
mirror of https://gitlab.com/CreepySkeleton/proc-macro-error
Rust★ 8↓ 28.1M/moJul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0