Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
36,617
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
345 recordsRanked by popularity · browse by tag · record statistics
npm
39At riskhealth index
feross/queue-microtask
fast, tiny `queueMicrotask` shim for modern engines
JavaScript★ 189↓ 488M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
37At riskhealth index
philchia/agollo
agollo is a golang client for ctrip apollo config center 🚀
Go★ 182Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
24Criticalhealth index
kevinbeaty/any-promise
NOTE: You probably want native promises now
JavaScript★ 181↓ 262M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
mathiasbynens/cssesc
A JavaScript library for escaping CSS strings and identifiers while generating the shortest possible ASCII-only output.
HTML · JavaScript★ 176↓ 377M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
micromatch/to-regex-range
Pass two numbers, get a regex-compatible source string for matching ranges. Fast compiler, optimized regex, and validated against more than 2.78 million test assertions. Useful for creating regular expressions to validate numbers, ranges, years, etc.
JavaScript★ 173↓ 605M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
25Criticalhealth index
teambition/merge2
Merge multiple streams into one stream in sequence or parallel (~119M/month downloads).
JavaScript★ 171↓ 479M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
38At riskhealth index
thlorenz/convert-source-map
Converts a source-map from/to different formats.
JavaScript★ 171↓ 805M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
39At riskhealth index
sindresorhus/environment
Check which JavaScript environment your code is running in at runtime: browser, Node.js, Bun, etc
JavaScript★ 167↓ 133M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
36At riskhealth index
gkz/optionator
JavaScript option parsing and help generation library
LiveScript★ 166↓ 518M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
24Criticalhealth index
DaveRandom/LibDNS
DNS implementation in pure PHP
PHP★ 165↓ 2.7M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
16Criticalhealth index
flmnt/graphemer
Unicode character splitter
TypeScript★ 161↓ 195M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
28Criticalhealth index
jonschlinkert/is-plain-object
Returns true if the given value is an object created by the Object constructor.
HTML · JavaScript★ 158↓ 289M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
33At riskhealth index
sindresorhus/merge-descriptors
Merge objects using their property descriptors
JavaScript★ 157↓ 445M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
34At riskhealth index
yargs/y18n
:ledger: the bare-bones i18n library used by yargs
JavaScript · TypeScript★ 154↓ 622M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
Packagist
40At riskhealth index
amphp/parser
A generator parser to make streaming parsers simple.
PHP★ 152↓ 2.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
14Criticalhealth index
fitzgen/glob-to-regexp
Convert a glob to a regular expression
JavaScript★ 150↓ 180M/moJul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
20Criticalhealth index
mafintosh/end-of-stream
Call a callback when a readable/writable/duplex stream has completed or failed.
JavaScript★ 150↓ 366M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
felixge/node-combined-stream
A stream that emits multiple other streams one after another.
JavaScript★ 144↓ 463M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
23Criticalhealth index
fjc0k/taro-axios
在 Taro 中使用 axios。
TypeScript★ 140↓ 667/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
20Criticalhealth index
ampproject/remapping
Remap sequential sourcemaps through transformations to point at the original source code
TypeScript · JavaScript★ 137↓ 141M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
34At riskhealth index
istanbuljs/v8-to-istanbul
convert from v8 coverage format to istanbul's format
JavaScript★ 137↓ 173M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
npm
38At riskhealth index
sindresorhus/arrify
Convert a value to an array
TypeScript · JavaScript★ 133↓ 182M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm · Maven
28Criticalhealth index
shimohq/react-native-prompt-android
A polyfill library for Alert.prompt on Android platform, working both on Android and iOS platform.
Java · JavaScript · Objective-C★ 130↓ 28K/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
25Criticalhealth index
defunctzombie/node-process
process information for node.js and browsers
JavaScript★ 129Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
43At riskhealth index
chaijs/type-detect
Improved typeof detection for node.js and the browser.
JavaScript · TypeScript★ 128↓ 252M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
25Criticalhealth index
estools/esutils
utility box for ECMAScript language tools
CoffeeScript · JavaScript★ 123↓ 570M/moJul 22, 2026
BSD-2-ClauseJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
feross/ieee754
Read/write IEEE754 floating point numbers from/to a Buffer or array-like object.
JavaScript★ 121↓ 405M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
npm
38At riskhealth index
octokit/auth-token.js
GitHub API token authentication for browsers and Node.js
TypeScript · JavaScript★ 121↓ 128M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
38At riskhealth index
sindresorhus/is-interactive
Check if stdout or stderr is interactive
JavaScript · TypeScript★ 118↓ 250M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0