Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,118
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
378 recordsRanked by popularity · browse by tag · record statistics
PyPI
20Criticalhealth index
polaris-gslb/polaris-gslb
A free, open source GSLB (Global Server Load Balancing) solution.
Python★ 312Jul 23, 2026
Custom licenseJul 23, 2026 · metrics 1.13.0
PyPI
17Criticalhealth index
trezor/trezor-mcu
:lock: Don't use this repo, use the new monorepo instead:
C★ 312Jul 23, 2026
LGPL-3.0Jul 23, 2026 · metrics 1.13.0
npm
25Criticalhealth index
webpack/loader-runner
Runs (webpack) loaders
JavaScript★ 307↓ 182M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
16Criticalhealth index
Raynos/xtend
extend like a boss
JavaScript★ 306↓ 298M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
7Criticalhealth index
floatdrop/require-from-string
Load module from string
JavaScript★ 298↓ 452M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
24Criticalhealth index
IntersectMBO/plutus-apps
The Plutus application platform
Haskell★ 297Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
npm
24Criticalhealth index
publishlab/node-acme-client
Simple and unopinionated ACME client for Node.js
JavaScript★ 295↓ 567.7K/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
Maven · npm · RubyGems
27Criticalhealth index
wuba/taro-playground
The Taro Playground App is a cross-platform application developed using Taro, to help developers develop and debug Taro applications.
TypeScript★ 293Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
NuGet
23Criticalhealth index
MizunagiKB/gd_cubism
Unofficial Live2D Player for Godot Engine
C++ · CSS★ 289Jul 23, 2026
Custom licenseJul 23, 2026 · metrics 1.13.0
npm
47At riskhealth index
ehmicky/human-signals
Human-friendly process signals
JavaScript · TypeScript★ 286↓ 513M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
23Criticalhealth index
jonschlinkert/is-number
JavaScript/Node.js utility. Returns `true` if the value is a number or string number. Useful for checking regex match results, user input, parsed strings, etc.
JavaScript★ 284↓ 714M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
zertosh/loose-envify
Like envify but much faster
JavaScript★ 283↓ 434M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
20Criticalhealth index
then/is-promise
Test whether an object looks like a promises-a+ promise
JavaScript★ 282↓ 256M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
43At riskhealth index
pycroscopy/pycroscopy
Scientific analysis of nanoscale materials imaging data
Jupyter Notebook★ 279Jul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
PyPI
23Criticalhealth index
ARM-software/SCP-firmware
This System Control Processor (SCP) firmware repository is no longer used and has been set to Read-only for archiving purposes. Please refer to the following active repository.
C★ 265Jul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
—
21Criticalhealth index
timescale/helm-charts
Configuration and Documentation to run TimescaleDB in your Kubernetes cluster
Shell · Smarty · Mustache★ 262Jul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
37At riskhealth index
kornelski/http-cache-semantics
RFC 7234 in JavaScript. Parses HTTP headers to correctly compute cacheability of responses, even in complex cases
JavaScript★ 259↓ 248M/moJul 22, 2026
BSD-2-ClauseJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
ajv-validator/ajv-keywords
Additional JSON-Schema keywords for Ajv JSON validator
TypeScript★ 257Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
40At riskhealth index
webmozarts/glob
A PHP implementation of Ant's glob.
PHP★ 257↓ 1.4M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist · npm
22Criticalhealth index
felixfbecker/php-advanced-json-rpc
A more advanced PHP implementation of the JSONRPC Protocol 📞❗
PHP★ 255↓ 795.2K/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
Packagist · npm
13Criticalhealth index
csarrazi/CsaGuzzleBundle
A bundle integrating Guzzle >=4.0 in Symfony
PHP · Twig★ 250↓ 42K/moJul 24, 2026
No licenseJul 24, 2026 · metrics 1.13.0
Maven
37At riskhealth index
philburk/jsyn
Modular audio synthesizer library with unit generators in Java
Java★ 250Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
npm
26Criticalhealth index
micromatch/braces
Faster brace expansion for node.js. Besides being faster, braces is not subject to DoS attacks like minimatch, is more accurate, and has more complete support for Bash 4.3.
JavaScript★ 249↓ 664M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
40At riskhealth index
sindresorhus/load-json-file
Read and parse a JSON file
JavaScript · TypeScript★ 249↓ 98.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
29Criticalhealth index
redis-stack/redis-stack
A Redis server with additional database capabilities powered by Redis modules.
Python★ 236Jul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
30At riskhealth index
ajv-validator/ajv-formats
JSON Schema format validation for Ajv v8+
TypeScript★ 227↓ 440M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
19Criticalhealth index
paulirish/html5-boilerplate
THIS REPO HAS MOVED! It has a pretty new home at github.com/h5bp ╰☆╮Please click this link below.
JavaScript★ 223Jul 23, 2026
No licenseJul 23, 2026 · metrics 1.13.0
npm
25Criticalhealth index
microflo/microflo
Live dataflow programming for microcontrollers and embedded
CoffeeScript · C++★ 220↓ 268/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
40At riskhealth index
isaacs/yallist
Yet Another Linked List
TypeScript · JavaScript★ 217↓ 1.2B/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0