Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

37,433

Monthly downloads under inspection

379B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

1,301 recordsRanked by popularity · browse by tag · record statistics

npm

35At riskhealth index

pillarjs/iconv-lite

Convert character encodings in pure javascript.

JavaScript★ 3,175↓ 1.1B/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

37At riskhealth index

jaredwray/keyv

Simple key-value storage with support for multiple backends

TypeScript★ 3,164↓ 634M/moJul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

PyPI

49At riskhealth index

joke2k/django-environ

Django-environ allows you to utilize 12factor inspired environment variables to configure your Django application.

Python★ 3,163Jul 21, 2026

MITJul 21, 2026 · metrics 1.13.0

npm

38At riskhealth index

NaturalIntelligence/fast-xml-parser

Validate XML, Parse XML and Build XML rapidly without C/C++ based libraries and no callback.

JavaScript★ 3,118↓ 330M/moJul 19, 2026

MITJul 19, 2026 · metrics 1.13.0

RubyGems

22Criticalhealth index

trailblazer/cells

View components for Ruby and Rails.

Ruby★ 3,076Jul 21, 2026

No licenseJul 21, 2026 · metrics 1.13.0

npm

28Criticalhealth index

micromatch/micromatch

Highly optimized wildcard and glob matching library. Faster, drop-in replacement to minimatch and multimatch. Used by square, webpack, babel core, yarn, jest, ract-native, taro, bulma, browser-sync, stylelint, nyc, ava, and many others! Follow micromatch's author: https://github.com/jonschlinkert

JavaScript★ 3,036↓ 669M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

PyPI

32At riskhealth index

kayak/pypika

PyPika is a python SQL query builder that exposes the full richness of the SQL language using a syntax that reflects the resulting query. PyPika excels at all sorts of SQL queries but is especially useful for data analysis.

Python★ 2,926Jul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

Hex

33At riskhealth index

elixir-nx/nx

Multi-dimensional arrays (tensors) and numerical definitions for Elixir

Elixir★ 2,895↓ 83.2K/moJul 20, 2026

No licenseJul 20, 2026 · metrics 1.13.0

Packagist

35At riskhealth index

flightphp/core

An extensible micro-framework for PHP

PHP★ 2,878↓ 8,434/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

PyPI

40At riskhealth index

scrapinghub/dateparser

python parser for human readable dates

Python★ 2,843↓ 45.6M/moJul 20, 2026

BSD-3-ClauseJul 20, 2026 · metrics 1.13.0

PyPI

34At riskhealth index

deedy5/ddgs

A metasearch library that aggregates results from diverse web search services

Python★ 2,825Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm

12Criticalhealth index

mrmlnc/fast-glob

:rocket: It's a very fast and efficient glob library for Node.js

JavaScript · TypeScript★ 2,818↓ 593M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

PyPI

34At riskhealth index

tkem/cachetools

Extensible memoizing collections and decorators

Python★ 2,768↓ 322M/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm

29Criticalhealth index

salarcode/SmartProxy

Firefox/Chrome browser extension. SmartProxy will automatically enable/disable proxy for the sites you visit, based on customizable patterns.

TypeScript · CSS · HTML★ 2,710Jul 20, 2026

GPL-3.0Jul 20, 2026 · metrics 1.13.0

30At riskhealth index

bjarneo/cliamp

cliamp - Terminal music player inspired by winamp

Go★ 2,708Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

Packagist

26Criticalhealth index

schmittjoh/php-option

Option Type for PHP

PHP★ 2,675↓ 12.4M/moJul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

—

32At riskhealth index

samber/cc-skills-golang

🧑‍🎨 A collection of Golang agentic skills that works

Go · Makefile★ 2,670Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm

49At riskhealth index

ealush/vest

Vest ✅ Declarative validations framework

TypeScript★ 2,664Jul 19, 2026

MITJul 19, 2026 · metrics 1.13.0

—

33At riskhealth index

divkit/divkit

DivKit is an open source Server-Driven UI (SDUI) framework. SDUI is a an emerging technique that leverage the server to build the user interfaces of their mobile app

Kotlin · Swift★ 2,646Jul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

Packagist

42At riskhealth index

php-http/httplug

HTTPlug, the HTTP client abstraction for PHP

PHP★ 2,595↓ 6.3M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm · PyPI

40At riskhealth index

OpenLineage/OpenLineage

An Open Standard for lineage metadata collection