Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

36,684

Monthly downloads under inspection

379B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

350 recordsRanked by popularity · browse by tag · record statistics

npm

27Criticalhealth index

samn/json-stable-stringify

deterministic JSON.stringify() with custom sorting to get deterministic hashes from stringified results

JavaScript★ 13↓ 508M/moJul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

npm

33At riskhealth index

wooorm/bail

Throw if given an error

JavaScript · TypeScript★ 12↓ 169M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

15Criticalhealth index

CycloneDX/cdxgen-action

GitHub action for CycloneDX BOM generator (cdxgen). cdxgen produced bom xml file can be uploaded to dependency track, AppThreat and other commercial Software Composition Analysis (SCA) products

JavaScript★ 11Jul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Packagist

30At riskhealth index

composer-unused/contracts

Contract repository for composer-unused

PHP★ 11↓ 380.9K/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

32At riskhealth index

shikijs/vscode-textmate

Shiki's fork of `vscode-textmate`

TypeScript★ 11↓ 61.5M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

31At riskhealth index

unshiftio/requires-port

Check if a protocol requires a certain port number to be added to an URL.

JavaScript★ 11↓ 191M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

31At riskhealth index

wooorm/comma-separated-tokens

Parse and stringify comma-separated tokens

JavaScript★ 11↓ 176M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

34At riskhealth index

STARRY-S/zip

Go zip library with Append (Updater) support.

Go★ 10Jul 23, 2026

BSD-3-ClauseJul 23, 2026 · metrics 1.13.0

npm

38At riskhealth index

isaacs/package-json-from-dist

No repository description published.

TypeScript★ 10↓ 387M/moJul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

npm

34At riskhealth index

wooorm/space-separated-tokens

Parse and stringify space-separated tokens

JavaScript★ 10↓ 172M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

29Criticalhealth index

VdustR/hanamin

A webfont repository for Hanamin

CSS★ 9↓ 365/moJul 24, 2026

MITJul 24, 2026 · metrics 1.13.0

npm

19Criticalhealth index

radxa/mraa

Linux Library for low speed IO Communication in C with bindings for C++, Python, Node.js & Java. Supports generic io platforms, as well as Intel Edison, Intel Joule, Raspberry Pi and many more.

C★ 9Jul 23, 2026

MITJul 23, 2026 · metrics 1.13.0

npm

23Criticalhealth index

wooorm/character-entities

Map of named character references.

JavaScript★ 9↓ 197M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

31At riskhealth index

wooorm/longest-streak

Count the longest repeating streak of a substring

JavaScript★ 9↓ 164M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

—

35At riskhealth index

MartiUK/cmder

Lovely console emulator package for Windows

C++ · PowerShell★ 8Jul 23, 2026

MITJul 23, 2026 · metrics 1.13.0

Packagist

42At riskhealth index

kiwilan/php-xml-reader

PHP package to read XML with nice API.

PHP★ 7↓ 19.4K/moJul 23, 2026

MITJul 23, 2026 · metrics 1.13.0

npm

25Criticalhealth index

rashfael/buntpapier

mixin-based component library

Stylus · Vue · JavaScript★ 7↓ 10.3K/moJul 23, 2026

MITJul 23, 2026 · metrics 1.13.0

—

16Criticalhealth index

Arachnid/go-ethereum

Official golang implementation of the Ethereum protocol

Go★ 6Jul 22, 2026

LGPL-3.0Jul 22, 2026 · metrics 1.13.0

Packagist

28Criticalhealth index

CodersCare/gridelements

Be part of the future of TYPO3! Support Gridelements now and unlock exclusive early access to v13! The well-established Gridelements V12 elevates TYPO3 by bringing grid-based layouts to content elements, with powerful features like advanced drag & drop and real references. Supercharge your workflow and make daily tasks easier. Sponsor us here:

PHP · JavaScript★ 6↓ 8,460/moJul 23, 2026