Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

38,377

Monthly downloads under inspection

380B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

1,710 recordsRanked by popularity · browse by tag · record statistics

npm

25Criticalhealth index

estools/esutils

utility box for ECMAScript language tools

CoffeeScript · JavaScript★ 123↓ 570M/moJul 22, 2026

BSD-2-ClauseJul 22, 2026 · metrics 1.13.0

RubyGems

34At riskhealth index

ruby/uri

URI is a module providing classes to handle Uniform Resource Identifiers

Ruby★ 123Jul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

—

29Criticalhealth index

ForNeVeR/tdlib.native

Prebuilt binaries of TDLib distributed as a NuGet package.

F# · PowerShell★ 121Jul 20, 2026

BSL-1.0Jul 20, 2026 · metrics 1.13.0

Hex

24Criticalhealth index

bitwalker/uniq

Provides UUID generation, parsing, and formatting. Supports RFC 4122, and the v6 draft extension

Elixir★ 121↓ 185.5K/moJul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

npm

24Criticalhealth index

feross/ieee754

Read/write IEEE754 floating point numbers from/to a Buffer or array-like object.

JavaScript★ 121↓ 405M/moJul 22, 2026

BSD-3-ClauseJul 22, 2026 · metrics 1.13.0

npm

38At riskhealth index

octokit/auth-token.js

GitHub API token authentication for browsers and Node.js

TypeScript · JavaScript★ 121↓ 128M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

crates.io

47At riskhealth index

dfinity/ic-wasm

A collection of libraries and tools for transforming Wasm canisters running on the Internet Computer

Rust★ 120↓ 21.4K/moJul 21, 2026

Apache-2.0Jul 21, 2026 · metrics 1.13.0

crates.io

19Criticalhealth index

sebastienrousseau/serde_yml

[DEPRECATED] Final release is a thin compatibility shim. RUSTSEC-2025-0068 structurally fixed in 0.0.13. Migrate to a maintained alternative — see MIGRATION.md.

Rust · Makefile★ 120↓ 2.3M/moJul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

Packagist

37At riskhealth index

yiisoft/active-record

Active Record pattern implementation

PHP★ 120↓ 6,075/moJul 20, 2026

BSD-3-ClauseJul 20, 2026 · metrics 1.13.0

NuGet

24Criticalhealth index

madeyoga/AuthEndpoints

A simple jwt library for aspnetcore that provides a set of minimal api endpoints to handle authentication actions

C#★ 119Jul 24, 2026

MITJul 24, 2026 · metrics 1.13.0

npm

26Criticalhealth index

oceanprotocol/ocean.js

🦑 Ocean Protocol JavaScript library to privately & securely publish, exchange, and consume data.

TypeScript★ 118↓ 6,692/moJul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

npm

38At riskhealth index

sindresorhus/is-interactive

Check if stdout or stderr is interactive

JavaScript · TypeScript★ 118↓ 250M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

NuGet

32At riskhealth index

JKorf/Kucoin.Net

A C# .netstandard client library for the Kucoin REST and Websocket Spot and Futures API focusing on clear usage and models

C#★ 117Jul 21, 2026

MITJul 21, 2026 · metrics 1.13.0

Go · PyPI

49At riskhealth index

JetBrains/teamcity-cli

TeamCity from your terminal – or your AI's. Builds, logs, agents, agent terminals, queues.

Go★ 117Jul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

Packagist

34At riskhealth index

guzzle/command

Provides the foundation for building web service clients with Guzzle

PHP★ 116↓ 187.1K/moJul 20, 2026

MITJul 20, 2026 · metrics 1.13.0

Hex

22Criticalhealth index

mirego/absinthe_error_payload

Bridges the gap between Ecto and Absinthe for mutation payload

Elixir★ 116↓ 33.2K/moJul 20, 2026

Custom licenseJul 20, 2026 · metrics 1.13.0

npm

28Criticalhealth index

neondatabase/neonctl

Neon CLI tool. The Neon CLI is a command-line interface that lets you manage Neon Serverless Postgres directly from the terminal.

TypeScript★ 116Jul 24, 2026

Apache-2.0Jul 24, 2026 · metrics 1.13.0

24Criticalhealth index

nuixyz/kanarenshu

A minimal TUI application to practise Japanese from the terminal.

Go★ 116Jul 21, 2026

MITJul 21, 2026 · metrics 1.13.0

Packagist

27Criticalhealth index

patrickbussmann/oauth2-apple

PHP★ 116↓ 86.4K/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

—

34At riskhealth index

ydb-platform/ydb-dotnet-sdk

YDB .NET SDK

C# · TSQL★ 116Jul 20, 2026

Apache-2.0Jul 20, 2026 · metrics 1.13.0

—

29Criticalhealth index

StackStorm/stackstorm-k8s

K8s Helm Chart that codifies StackStorm (aka "IFTTT for Ops" https://stackstorm.com/) Highly Availability fleet as a simple to use reproducible infrastructure-as-code app

Smarty · Shell★ 114Jul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

PyPI

10Criticalhealth index

dev-petrov/pytest-lazy-fixtures

Allows you to use fixtures in @pytest.mark.parametrize.

Python★ 114↓ 1.8M/moJul 21, 2026

MITJul 21, 2026 · metrics 1.13.0

—

25Criticalhealth index

yandex-cloud/cloudapi

Interface definitions of Yandex.Cloud API