Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

38,417

Monthly downloads under inspection

380B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

1,763 recordsRanked by popularity · browse by tag · record statistics

npm

34At riskhealth index

npm/node-which

Like which(1) unix command. Find the first instance of an executable in the PATH.

JavaScript★ 352↓ 1.2B/moJul 22, 2026

ISCJul 22, 2026 · metrics 1.13.0

npm

41At riskhealth index

syntax-tree/unist-util-visit

utility to visit nodes

JavaScript · TypeScript★ 352↓ 210M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

PyPI

32At riskhealth index

ton-blockchain/mytonctrl

A tool to run and maintain a TON node/validator

Python★ 352Jul 21, 2026

GPL-3.0Jul 21, 2026 · metrics 1.13.0

—

16Criticalhealth index

redromnon/HeroicBashLauncher

Directly launch any Epic Games Store and GOG game from anywhere without Heroic on Linux.

Python★ 351Jul 24, 2026

GPL-3.0Jul 24, 2026 · metrics 1.13.0

npm

24Criticalhealth index

feross/safe-buffer

Safer Node.js Buffer API

JavaScript★ 350↓ 1.1B/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Packagist

22Criticalhealth index

prologuephp/alerts

Alerts is a package that handles global site messages.

PHP★ 348↓ 147.6K/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

PyPI

33At riskhealth index

istupakov/onnx-asr

A lightweight Python package for Automatic Speech Recognition using ONNX models

Python★ 347↓ 244.7K/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm

30At riskhealth index

marcomontalbano/figma-export

Export tool for Figma. You can easily and automatically export your Figma components and use them directly into your website.

TypeScript · HTML★ 347Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

Packagist

23Criticalhealth index

SimpleBus/message-bus

[READ ONLY] Generic classes and interfaces for messages and message buses. Full documentation can be found here:

PHP★ 346↓ 44K/moJul 24, 2026

MITJul 24, 2026 · metrics 1.13.0

—

22Criticalhealth index

pawn-lang/compiler

Pawn compiler for SA-MP with bug fixes and new features - runs on Windows, Linux, macOS

C · Assembly★ 340Jul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

npm

29Criticalhealth index

dougwilson/nodejs-depd

Deprecate all the things

JavaScript★ 329↓ 499M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

—

25Criticalhealth index

kframework/c-semantics

Semantics of C in K

C · OCaml★ 328Jul 23, 2026

Custom licenseJul 23, 2026 · metrics 1.13.0

Packagist

37At riskhealth index

php-mod/curl

This library provides an object-oriented and dependency free wrapper of the PHP cURL extension.

PHP★ 327↓ 284.7K/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

crates.io

29Criticalhealth index

binance/binance-connector-rust

Simple Rust connector to Binance API

Rust★ 326↓ 9,915/moJul 21, 2026

MITJul 21, 2026 · metrics 1.13.0

Maven

21Criticalhealth index

open-osrs/runelite

Actually open source Old School RuneScape client

Java★ 326Jul 24, 2026

BSD-2-ClauseJul 24, 2026 · metrics 1.13.0

Packagist · PyPI

49At riskhealth index

cognesy/instructor-php

Unified LLM API, structured data outputs with LLMs, and agent SDK - in PHP

PHP★ 325↓ 5,250/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

Hex

23Criticalhealth index

peburrows/goth

Elixir package for Oauth authentication via Google Cloud APIs

Elixir★ 323↓ 236.3K/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

npm

22Criticalhealth index

epoberezkin/fast-json-stable-stringify

Deterministic JSON.stringify() - a faster version of @substack's json-stable-strigify without jsonify.

JavaScript★ 322↓ 586M/moJul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

npm

43At riskhealth index

ungap/structured-clone

A structuredClone polyfill

JavaScript★ 322↓ 295M/moJul 22, 2026

ISCJul 22, 2026 · metrics 1.13.0

npm

24Criticalhealth index

garycourt/uri-js

An RFC 3986 compliant, scheme extendable URI parsing/validating/normalizing/resolving library for JavaScript

JavaScript · TypeScript★ 317↓ 573M/moJul 22, 2026

Custom licenseJul 22, 2026 · metrics 1.13.0

npm

26Criticalhealth index

jonschlinkert/clone-deep

Recursively (deep) clone JavaScript native types, like Object, Array, RegExp, Date as well as primitives. Used by superstruct, merge-deep, and many others!

JavaScript★ 317↓ 110M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

30At riskhealth index

tonkeeper/tongo

Golang SDK for from Tonkeeper team

Go★ 316Jul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

28Criticalhealth index

startfellows/tongo

Golang SDK for from Tonkeeper team

Go★ 315Jul 19, 2026

MITJul 19, 2026 · metrics 1.13.0