Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

37,266

Monthly downloads under inspection

379B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

383 recordsRanked by popularity · browse by tag · record statistics

npm

20Criticalhealth index

mafintosh/end-of-stream

Call a callback when a readable/writable/duplex stream has completed or failed.

JavaScript★ 150↓ 366M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

26Criticalhealth index

felixge/node-combined-stream

A stream that emits multiple other streams one after another.

JavaScript★ 144↓ 463M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

—

31At riskhealth index

tdelenikas/smslib-v3

SMSLib v3.5.x

Java★ 143Jul 24, 2026

Apache-2.0Jul 24, 2026 · metrics 1.13.0

npm

23Criticalhealth index

fjc0k/taro-axios

在 Taro 中使用 axios。

TypeScript★ 140↓ 667/moJul 23, 2026

MITJul 23, 2026 · metrics 1.13.0

npm

48At riskhealth index

syntax-tree/mdast-util-to-markdown

mdast utility to serialize markdown

JavaScript★ 140↓ 157M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

20Criticalhealth index

ampproject/remapping

Remap sequential sourcemaps through transformations to point at the original source code

TypeScript · JavaScript★ 137↓ 141M/moJul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

npm

34At riskhealth index

istanbuljs/v8-to-istanbul

convert from v8 coverage format to istanbul's format

JavaScript★ 137↓ 173M/moJul 22, 2026

ISCJul 22, 2026 · metrics 1.13.0

npm

38At riskhealth index

sindresorhus/arrify

Convert a value to an array

TypeScript · JavaScript★ 133↓ 182M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm · Maven

28Criticalhealth index

shimohq/react-native-prompt-android

A polyfill library for Alert.prompt on Android platform, working both on Android and iOS platform.

Java · JavaScript · Objective-C★ 130↓ 28K/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

25Criticalhealth index

defunctzombie/node-process

process information for node.js and browsers

JavaScript★ 129Jul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

43At riskhealth index

chaijs/type-detect

Improved typeof detection for node.js and the browser.

JavaScript · TypeScript★ 128↓ 252M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

25Criticalhealth index

estools/esutils

utility box for ECMAScript language tools

CoffeeScript · JavaScript★ 123↓ 570M/moJul 22, 2026

BSD-2-ClauseJul 22, 2026 · metrics 1.13.0

npm

24Criticalhealth index

feross/ieee754

Read/write IEEE754 floating point numbers from/to a Buffer or array-like object.

JavaScript★ 121↓ 405M/moJul 22, 2026

BSD-3-ClauseJul 22, 2026 · metrics 1.13.0

npm

38At riskhealth index

octokit/auth-token.js

GitHub API token authentication for browsers and Node.js

TypeScript · JavaScript★ 121↓ 128M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

26Criticalhealth index

oceanprotocol/ocean.js

🦑 Ocean Protocol JavaScript library to privately & securely publish, exchange, and consume data.

TypeScript★ 118↓ 6,692/moJul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

npm

38At riskhealth index

sindresorhus/is-interactive

Check if stdout or stderr is interactive

JavaScript · TypeScript★ 118↓ 250M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

28Criticalhealth index

neondatabase/neonctl

Neon CLI tool. The Neon CLI is a command-line interface that lets you manage Neon Serverless Postgres directly from the terminal.

TypeScript★ 116Jul 24, 2026

Apache-2.0Jul 24, 2026 · metrics 1.13.0

—

29Criticalhealth index

StackStorm/stackstorm-k8s

K8s Helm Chart that codifies StackStorm (aka "IFTTT for Ops" https://stackstorm.com/) Highly Availability fleet as a simple to use reproducible infrastructure-as-code app

Smarty · Shell★ 114Jul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

npm

37At riskhealth index

jsdom/js-symbol-tree

Turn any collection of objects into its own efficient tree or linked list using Symbol

JavaScript★ 113↓ 263M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

34At riskhealth index

jonschlinkert/normalize-path

Normalize file path slashes to be unix-like forward slashes. Used by chokidar, anymatch, and many others!