Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

38,406

Monthly downloads under inspection

380B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

1,763 recordsRanked by popularity · browse by tag · record statistics

npm

40At riskhealth index

sindresorhus/merge-streams

Merge multiple streams into a unified stream

JavaScript★ 65↓ 127M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Maven

23Criticalhealth index

subutai-io/peer-os

Subutai is a next generation peer to peer (P2P) cloud computing and Internet of Things platform. Subutai peers collaborate and share resources to create secure virtual environments tying together the shared network and machine resources across peers.

Java · JavaScript★ 65Jul 25, 2026

Apache-2.0Jul 25, 2026 · metrics 1.13.0

PyPI

31At riskhealth index

Placekey/placekey-py

No repository description published.

Python★ 64↓ 87.4K/moJul 24, 2026

Apache-2.0Jul 24, 2026 · metrics 1.13.0

PyPI

39At riskhealth index

pyupio/dparse

A parser for Python dependency files

Python★ 64↓ 4.5M/moJul 21, 2026

MITJul 21, 2026 · metrics 1.13.0

Packagist

28Criticalhealth index

spiral/roadrunner-bridge

🌉 RoadRunner bridge to Spiral Framework

PHP★ 64↓ 119.7K/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

31At riskhealth index

AdguardTeam/FiltersCompiler

A tool that compiles & validates filters

JavaScript★ 63↓ 135/moJul 20, 2026

LGPL-3.0Jul 20, 2026 · metrics 1.13.0

npm

34At riskhealth index

ota-meshi/eslint-plugin-markdown-preferences

ESLint plugin that enforces our markdown preferences.

TypeScript★ 63↓ 59.4K/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm

18Criticalhealth index

peterszombati/xapi-node

xStation5 Trading API for NodeJS/JS

TypeScript★ 63↓ 2,293/moJul 24, 2026

Custom licenseJul 24, 2026 · metrics 1.13.0

Packagist

34At riskhealth index

yiisoft/router

Router is a request matcher and URL generator

PHP★ 62↓ 17.1K/moJul 20, 2026

BSD-3-ClauseJul 20, 2026 · metrics 1.13.0

33At riskhealth index

GoPolymarket/polymarket-go-sdk

Core Polymarket infrastructure repository maintained under governance.

Go★ 61Jul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

npm

45At riskhealth index

jshttp/forwarded

Parse HTTP X-Forwarded-For header

JavaScript★ 61↓ 329M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

RubyGems

31At riskhealth index

launchdarkly/ruby-eventsource

Server-Sent Events client for Ruby

Ruby★ 61Jul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

npm

38At riskhealth index

sindresorhus/mimic-response

Mimic a Node.js HTTP response stream

JavaScript★ 61↓ 253M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Maven

23Criticalhealth index

spinnaker/front50

Spinnaker Metadata Repository Service

Java · Groovy · Kotlin★ 61Jul 25, 2026

Apache-2.0Jul 25, 2026 · metrics 1.13.0

npm

42At riskhealth index

jonschlinkert/fill-range

Fill in a range of numbers or letters, positive or negative, optionally passing an increment or multiplier to use.

JavaScript★ 60↓ 661M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

PyPI

28Criticalhealth index

mgeier/sphinx-last-updated-by-git

:watch: Get the "last updated" time for each Sphinx page from Git

Python★ 60↓ 503.5K/moJul 20, 2026

BSD-2-ClauseJul 20, 2026 · metrics 1.13.0

—

22Criticalhealth index

processone/iconv

Fast encoding conversion library for Erlang / Elixir

Shell · Erlang★ 60Jul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

npm

49At riskhealth index

web-platform-dx/baseline-browser-mapping

baseline-browser-mapping exposes arrays of browsers compatible with Baseline Widely Available and specified Baseline year feature sets.

JavaScript · TypeScript★ 59↓ 556M/moJul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

NuGet

12Criticalhealth index

VahidFarahmandian/Jinget

Jinget is a high-performance .NET 8.0 framework built with DDD + CQRS at its core. It's your Swiss Army knife for cutting through boilerplate code and supercharging productivity.

C#★ 58Jul 21, 2026

MITJul 21, 2026 · metrics 1.13.0

npm

26Criticalhealth index

grammyjs/storages

Storage adapters for grammY sessions.

TypeScript★ 58Jul 20, 2026

No licenseJul 20, 2026 · metrics 1.13.0

Packagist

36At riskhealth index

laminas/laminas-stratigility

PSR-7 middleware foundation for building and dispatching middleware pipelines