Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

37,673

Monthly downloads under inspection

379B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

1,665 recordsRanked by popularity · browse by tag · record statistics

npm

31At riskhealth index

wooorm/comma-separated-tokens

Parse and stringify comma-separated tokens

JavaScript★ 11↓ 176M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Packagist

29Criticalhealth index

yiisoft/input-http

Provides Yii Hydrator attributes to get data from PSR-7 HTTP request and adds extra abilities to middlewares processed by Yii Middleware Dispatcher.

PHP★ 11↓ 9,001/moJul 20, 2026

BSD-3-ClauseJul 20, 2026 · metrics 1.13.0

Packagist

26Criticalhealth index

Automattic/jetpack-changelogger

[READ ONLY] Allows for managing changelogs by dropping change files into a changelog directory with each PR. This repository is a mirror, for issue tracking and development head to: https://github.com/automattic/jetpack

PHP★ 10↓ 186.1K/moJul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

Packagist

24Criticalhealth index

Automattic/jetpack-device-detection

[READ ONLY] A method to detect device types, originates from `jetpack_is_mobile`. This repository is a mirror, for issue tracking and development head to: https://github.com/automattic/jetpack

PHP★ 10↓ 38.4K/moJul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

34At riskhealth index

STARRY-S/zip

Go zip library with Append (Updater) support.

Go★ 10Jul 23, 2026

BSD-3-ClauseJul 23, 2026 · metrics 1.13.0

Packagist

24Criticalhealth index

TheDragonCode/contracts

The Dragon Code's Contracts collection

PHP★ 10↓ 512.8K/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm

38At riskhealth index

isaacs/package-json-from-dist

No repository description published.

TypeScript★ 10↓ 387M/moJul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

RubyGems

33At riskhealth index

kontena/kontena-loadbalancer

Kontena Load Balancer

Ruby · Shell★ 10Jul 24, 2026

Apache-2.0Jul 24, 2026 · metrics 1.13.0

crates.io

34At riskhealth index

oxc-project/oxc-miette

Forked version of miette

Rust★ 10↓ 1.1M/moJul 19, 2026

Apache-2.0Jul 19, 2026 · metrics 1.13.0

npm

34At riskhealth index

wooorm/space-separated-tokens

Parse and stringify space-separated tokens

JavaScript★ 10↓ 172M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

28Criticalhealth index

yandex-cloud/go-genproto

Go generated proto packages

Mixed★ 10Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

Packagist

29Criticalhealth index

yiisoft/yii-http

Yii HTTP Application

PHP★ 10↓ 14K/moJul 20, 2026

BSD-3-ClauseJul 20, 2026 · metrics 1.13.0

Packagist

29Criticalhealth index

yiisoft/yii-runner-console

Yii Console Runner

PHP★ 10↓ 12.1K/moJul 20, 2026

BSD-3-ClauseJul 20, 2026 · metrics 1.13.0

Packagist

32At riskhealth index

yiisoft/yii-runner-http

Yii HTTP Runner

PHP★ 10↓ 11.6K/moJul 20, 2026

BSD-3-ClauseJul 20, 2026 · metrics 1.13.0

Packagist

26Criticalhealth index

Automattic/jetpack-licensing

[READ ONLY] A Licensing Package that attaches Jetpack licenses. This repository is a mirror, for issue tracking and development head to: https://github.com/automattic/jetpack

PHP★ 9↓ 1,906/moJul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

34At riskhealth index

Edge-Center/terraform-provider-edgecenter

EdgeCenter Cloud Terraform Provider

Go★ 9Jul 20, 2026

MPL-2.0Jul 20, 2026 · metrics 1.13.0

npm

29Criticalhealth index

VdustR/hanamin

A webfont repository for Hanamin

CSS★ 9↓ 365/moJul 24, 2026

MITJul 24, 2026 · metrics 1.13.0

34At riskhealth index

deckhouse/sds-local-volume

No repository description published.

Go★ 9Jul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

PyPI

31At riskhealth index

infraguys/restalchemy

No repository description published.

Python★ 9Jul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

Packagist

22Criticalhealth index

mindbox-cloud/php-sdk

No repository description published.

PHP★ 9↓ 13.2K/moJul 23, 2026

No licenseJul 23, 2026 · metrics 1.13.0

npm

19Criticalhealth index

radxa/mraa

Linux Library for low speed IO Communication in C with bindings for C++, Python, Node.js & Java. Supports generic io platforms, as well as Intel Edison, Intel Joule, Raspberry Pi and many more.

C★ 9Jul 23, 2026

MITJul 23, 2026 · metrics 1.13.0

Packagist