Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,369
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
1,580 recordsRanked by popularity · browse by tag · record statistics
npm
22Criticalhealth index
sindresorhus/pify
Promisify a callback-style function
JavaScript · TypeScript★ 1,505↓ 555M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
36At riskhealth index
requests-cache/requests-cache
Persistent HTTP cache for python requests
Python★ 1,499Jul 20, 2026
BSD-2-ClauseJul 20, 2026 · metrics 1.13.0
PyPI
26Criticalhealth index
lidatong/dataclasses-json
Easily serialize Data Classes to and from JSON
Python★ 1,485Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
33At riskhealth index
emcconville/wand
The ctypes-based simple ImageMagick binding for Python
Python★ 1,481↓ 1.4M/moJul 21, 2026
Custom licenseJul 21, 2026 · metrics 1.13.0
Packagist
36At riskhealth index
slevomat/coding-standard
Slevomat Coding Standard for PHP_CodeSniffer provides many useful sniffs
PHP★ 1,479↓ 3.5M/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
npm
29Criticalhealth index
lukeed/dequal
A tiny (304B to 489B) utility to check for deep equality
JavaScript★ 1,467↓ 292M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go · Maven
30At riskhealth index
sartoopjj/thefeed
DNS-based feed reader and lite messenger for environments where only DNS queries work. Read Telegram channels and public X accounts, and exchange end-to-end-encrypted messages with other users — all over DNS.
Go · JavaScript★ 1,456Jul 18, 2026
MITJul 18, 2026 · metrics 1.13.0
—
30At riskhealth index
gleam-wisp/wisp
🧚 A practical web framework for Gleam
Gleam★ 1,452Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
npm
32At riskhealth index
sezna/nps
NPM Package Scripts -- All the benefits of npm scripts without the cost of a bloated package.json and limits of json
JavaScript★ 1,450↓ 169.9K/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
49At riskhealth index
microlinkhq/unavatar
Get unified user avatar from social networks, including Instagram, SoundCloud, Telegram, Twitter, YouTube & more.
HTML★ 1,448Jul 19, 2026
MITJul 19, 2026 · metrics 1.13.0
Packagist
28Criticalhealth index
composer/installers
A Multi-Framework Composer Library Installer
PHP★ 1,440↓ 2.5M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
34At riskhealth index
bovigo/vfsStream
vfsStream is a stream wrapper for a virtual file system that may be helpful in unit tests to mock the real file system. It can be used with any unit test framework, like PHPUnit or SimpleTest.
PHP★ 1,436↓ 2M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
—
24Criticalhealth index
serilog/serilog-aspnetcore
Serilog integration for ASP.NET Core
C#★ 1,427Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
RubyGems
28Criticalhealth index
atipugin/telegram-bot-ruby
Ruby wrapper for Telegram's Bot API
Ruby★ 1,425Jul 23, 2026
WTFPLJul 23, 2026 · metrics 1.13.0
—
32At riskhealth index
benoitc/hackney
simple HTTP client in Erlang
Erlang★ 1,415Jul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
npm
26Criticalhealth index
browserify/events
Node's event emitter for all engines.
JavaScript★ 1,409Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
34At riskhealth index
PeculiarVentures/PKI.js
PKI.js is a pure JavaScript library implementing the formats that are used in PKI applications (signing, encryption, certificate requests, OCSP and TSP requests/responses). It is built on WebCrypto (Web Cryptography API) and requires no plug-ins.
TypeScript★ 1,391↓ 25.3M/moJul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
Packagist
38At riskhealth index
JetBrains/phpstorm-stubs
PHP runtime & extensions header files for PhpStorm
PHP★ 1,390↓ 1.9M/moJul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
npm
26Criticalhealth index
normalize/mz
modernize node.js to current ECMAScript standards
JavaScript★ 1,369↓ 259M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist · npm
36At riskhealth index
amnuts/opcache-gui
A clean, effective and responsive interface for Zend OPcache
PHP · JavaScript★ 1,362↓ 80.4K/moJul 24, 2026
No licenseJul 24, 2026 · metrics 1.13.0
—
38At riskhealth index
bitfoundation/bitplatform
Build all of your apps using what you already know and love ❤️
C# · HTML★ 1,359Jul 19, 2026
MITJul 19, 2026 · metrics 1.13.0
Go
32At riskhealth index
kubenetworks/kubevpn
KubeVPN offers a Cloud Native Dev Environment that connects to kubernetes cluster network.
Go★ 1,355Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
—
36At riskhealth index
subsquid/squid-sdk
TypeScript ETL toolkit for indexing Ethereum, Solana, and Substrate data, sourced from SQD Network.
TypeScript★ 1,334Jul 19, 2026
Apache-2.0Jul 19, 2026 · metrics 1.13.0
PyPI
39At riskhealth index
pypa/pip-audit
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
Python★ 1,333↓ 24.2M/moJul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
npm
33At riskhealth index
sourcey/sourcey
Precision documentation from OpenAPI, MCP, Doxygen, and Markdown guides. Static HTML you own.
TypeScript★ 1,332↓ 4,079/moJul 20, 2026
AGPL-3.0Jul 20, 2026 · metrics 1.13.0
Packagist
28Criticalhealth index
php-http/discovery
Finds installed clients and message factories
PHP★ 1,324↓ 8.8M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm · Maven
38At riskhealth index
software-mansion/react-native-enriched-html
HTML-based Rich Text solution for React Native
C · TypeScript · Objective-C++★ 1,322↓ 116.4K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
28Criticalhealth index
php-http/message
HTTP Message related tools
PHP★ 1,318↓ 4.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
40At riskhealth index
deckhouse/deckhouse
Kubernetes platform from Flant
Go★ 1,317Jul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
npm
42At riskhealth index
isaacs/node-graceful-fs
fs with incremental backoff on EMFILE
JavaScript★ 1,303↓ 753M/moJul 22, 2026
BlueOak-1.0.0Jul 22, 2026 · metrics 1.13.0