Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,425
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
418 recordsRanked by popularity · browse by tag · record statistics
Packagist
29Criticalhealth index
defuse/php-encryption
Simple Encryption in PHP.
PHP★ 3,865↓ 4.7M/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
22Criticalhealth index
facebook/regenerator
Source transformer enabling ECMAScript 6 generator functions in JavaScript-of-today.
JavaScript★ 3,826↓ 758.7K/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
33At riskhealth index
ralouphie/getallheaders
PHP getallheaders polyfill
PHP★ 3,794↓ 18.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
css/csso
CSS minifier with structural optimizations
JavaScript · CSS★ 3,788↓ 117M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
15Criticalhealth index
GodotSteam/GodotSteam
An ecosystem of tools for Godot Engine and Valve's Steam. For Linux, Mac, and Windows.
Mixed★ 3,726Jul 24, 2026
No licenseJul 24, 2026 · metrics 1.13.0
npm
26Criticalhealth index
mathiasbynens/he
A robust HTML entity encoder/decoder written in JavaScript.
JavaScript★ 3,601↓ 159M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
TehShrike/deepmerge
A library for deep (recursive) merging of Javascript objects
JavaScript★ 2,816↓ 336M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
27Criticalhealth index
estools/escodegen
ECMAScript code generator
JavaScript★ 2,688↓ 234M/moJul 22, 2026
BSD-2-ClauseJul 22, 2026 · metrics 1.13.0
npm
14Criticalhealth index
js-newbee/taro-yanxuan
首个 Taro 多端统一实例 - 网易严选（小程序 + H5 + React Native） - By 趣店 FED
JavaScript · CSS★ 2,661Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
Packagist
36At riskhealth index
php-fig/event-dispatcher
No repository description published.
PHP★ 2,286↓ 16.7M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
28Criticalhealth index
evanw/node-source-map-support
Adds source map support to node.js (for stack traces)
JavaScript★ 2,191↓ 491M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
27Criticalhealth index
alexei/sprintf.js
sprintf.js is a complete open source JavaScript sprintf implementation
JavaScript★ 2,140↓ 377M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
npm
18Criticalhealth index
msaktype/stylefmt
stylefmt is a tool that automatically formats stylesheets.
JavaScript · CSS★ 2,084Jul 23, 2026
Custom licenseJul 23, 2026 · metrics 1.13.0
npm
28Criticalhealth index
epoberezkin/fast-deep-equal
The fastest deep equality check with Date, RegExp and ES6 Map, Set and typed arrays support
JavaScript★ 2,047↓ 743M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Maven
18Criticalhealth index
airsonic/airsonic
:satellite: :cloud: :notes:Airsonic, a Free and Open Source community driven media server (fork of Subsonic and Libresonic)
Java · JavaScript★ 2,046Jul 23, 2026
GPL-3.0Jul 23, 2026 · metrics 1.13.0
npm
42At riskhealth index
mafintosh/why-is-node-running
Node is running but you don't know why? why-is-node-running is here to help you.
JavaScript★ 1,948↓ 268M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
44At riskhealth index
feross/buffer
The buffer module from node.js, for the browser.
JavaScript★ 1,888↓ 575M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
32At riskhealth index
hughsk/flat
:steam_locomotive: Flatten/unflatten nested Javascript objects
JavaScript★ 1,816↓ 121M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
npm
47At riskhealth index
frenic/csstype
Strict TypeScript and Flow types for style based on MDN data
TypeScript★ 1,811↓ 590M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
22Criticalhealth index
alexeyraspopov/picocolors
The tiniest and the fastest library for terminal output formatting with ANSI colors
JavaScript★ 1,736↓ 835M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
lukeed/kleur
The fastest Node.js library for formatting terminal text with ANSI colors~!
JavaScript · Shell★ 1,696↓ 316M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
28Criticalhealth index
mathiasbynens/punycode.js
A robust Punycode converter that fully complies to RFC 3492 and RFC 5891.
JavaScript★ 1,687↓ 786M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
34At riskhealth index
jorgebucaran/colorette
🌈Easily set your terminal text color & styles
JavaScript★ 1,625↓ 282M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
21Criticalhealth index
interactivethings/catalog
Create living style guides using Markdown or React
JavaScript · TypeScript★ 1,601↓ 4,545/moJul 23, 2026
BSD-3-ClauseJul 23, 2026 · metrics 1.13.0
npm
29Criticalhealth index
lukeed/dequal
A tiny (304B to 489B) utility to check for deep equality
JavaScript★ 1,467↓ 292M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
32At riskhealth index
sezna/nps
NPM Package Scripts -- All the benefits of npm scripts without the cost of a bloated package.json and limits of json
JavaScript★ 1,450↓ 169.9K/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
Packagist
34At riskhealth index
bovigo/vfsStream
vfsStream is a stream wrapper for a virtual file system that may be helpful in unit tests to mock the real file system. It can be used with any unit test framework, like PHPUnit or SimpleTest.
PHP★ 1,436↓ 2M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
browserify/events
Node's event emitter for all engines.
JavaScript★ 1,409Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
normalize/mz
modernize node.js to current ECMAScript standards
JavaScript★ 1,369↓ 259M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0