Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
38,043
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
1,660 recordsRanked by popularity · browse by tag · record statistics
Packagist
34At riskhealth index
mglaman/phpstan-drupal
Extension for PHPStan to allow analysis of Drupal code.
PHP★ 208↓ 750.5K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
36At riskhealth index
pytest-dev/pytest-order
pytest plugin that allows to customize the test execution order
Python★ 208Jul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
crates.io
9Criticalhealth index
yury/cidre
Apple frameworks bindings for rust
Rust★ 208↓ 107.8K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
10Criticalhealth index
andreyryabin/sprint.migration
Миграции для разработчиков (1С-Битрикс)
PHP★ 207↓ 4,466/moJul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
npm
28Criticalhealth index
jonschlinkert/word-wrap
Wrap words to a specified length.
JavaScript★ 207↓ 504M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
49At riskhealth index
ai/multiocular
ꙮ Review dependencies changes to prevent supply chain attack
TypeScript · Svelte★ 206↓ 2,593/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
31At riskhealth index
puregram/puregram
powerful and modern telegram bot api sdk for node.js and typescript 😁
TypeScript★ 206Jul 20, 2026
MPL-2.0Jul 20, 2026 · metrics 1.13.0
npm
15Criticalhealth index
broofa/node-int64
Support for representing 64-bit integers in JavaScript
JavaScript★ 205↓ 204M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
23Criticalhealth index
dbrgn/coverage-badge
Create badges/shields for your Python test coverage!
Python★ 204↓ 374.3K/moJul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
npm
17Criticalhealth index
psaren/taro-ui-vue
UI KIT for Taro/vue
SCSS · Vue · JavaScript★ 201↓ 723/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
PyPI
42At riskhealth index
sippy/b2bua
Sippy B2BUA is a RFC3261-compliant Session Initiation Protocol (SIP) stack and Back-to-back user agent (B2BUA) server software.
Python★ 201Jul 21, 2026
BSD-2-ClauseJul 21, 2026 · metrics 1.13.0
npm
40At riskhealth index
tapjs/signal-exit
when you want to fire an event no matter how a process exits.
TypeScript · JavaScript★ 201↓ 1B/moJul 22, 2026
BlueOak-1.0.0Jul 22, 2026 · metrics 1.13.0
npm
25Criticalhealth index
unclechu/node-deep-extend
Recursive extend module
JavaScript★ 201↓ 171M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
32At riskhealth index
yiisoft/yii2-gii
Yii 2 Gii Extension
PHP · SCSS★ 201↓ 213.1K/moJul 20, 2026
BSD-3-ClauseJul 20, 2026 · metrics 1.13.0
Hex
26Criticalhealth index
elixir-lang/elixir_make
A Make compiler for Mix
Elixir★ 200↓ 768.4K/moJul 20, 2026
No licenseJul 20, 2026 · metrics 1.13.0
npm
34At riskhealth index
isaacs/node-mkdirp
Recursively mkdir, like `mkdir -p`, but in node.js
TypeScript · JavaScript★ 199↓ 571M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
30At riskhealth index
tapjs/stack-utils
Captures and cleans stack traces.
JavaScript★ 197↓ 209M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
44At riskhealth index
amphp/dns
Async DNS resolution for PHP based on Amp.
PHP★ 194↓ 2.7M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Maven
30At riskhealth index
dma-ais/AisLib
DMA AisLib - Java library for handling AIS messages
Java★ 194Jul 24, 2026
Custom licenseJul 24, 2026 · metrics 1.13.0
RubyGems
22Criticalhealth index
rspec/rspec-collection_matchers
Collection cardinality matchers, extracted from rspec-expectations
Ruby★ 193Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
28Criticalhealth index
amphp/sync
Non-blocking synchronization primitives for PHP based on Amp and Revolt.
PHP★ 192↓ 2.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
32At riskhealth index
gristlabs/asttokens
Annotate Python AST trees with source text and token information
Python★ 192Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Packagist
44At riskhealth index
mck89/peast
JavaScript parser written in PHP that generates AST from your code according to ECMAScript specification
PHP★ 192↓ 1.4M/moJul 21, 2026
BSD-3-ClauseJul 21, 2026 · metrics 1.13.0
RubyGems
17Criticalhealth index
ruby-concurrency/thread_safe
Thread-safe collections for Ruby (merged with concurrent-ruby)
Java · Ruby★ 192Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
npm
39At riskhealth index
feross/queue-microtask
fast, tiny `queueMicrotask` shim for modern engines
JavaScript★ 189↓ 488M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
29Criticalhealth index
kbrew-dev/kbrew
kbrew is homebrew for Kubernetes
Go · Shell★ 189Jul 25, 2026
Apache-2.0Jul 25, 2026 · metrics 1.13.0
npm
39At riskhealth index
pillarjs/parseurl
parse a url with memoization
JavaScript★ 189↓ 386M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0