Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,633
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
436 recordsRanked by popularity · browse by tag · record statistics
npm
19Criticalhealth index
fjc0k/mounted
基于 Taro 的小程序组件库。
TypeScript · CSS★ 67↓ 153/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
40At riskhealth index
sindresorhus/merge-streams
Merge multiple streams into a unified stream
JavaScript★ 65↓ 127M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
31At riskhealth index
Placekey/placekey-py
No repository description published.
Python★ 64↓ 87.4K/moJul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0
npm
18Criticalhealth index
peterszombati/xapi-node
xStation5 Trading API for NodeJS/JS
TypeScript★ 63↓ 2,293/moJul 24, 2026
Custom licenseJul 24, 2026 · metrics 1.13.0
npm
45At riskhealth index
jshttp/forwarded
Parse HTTP X-Forwarded-For header
JavaScript★ 61↓ 329M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
38At riskhealth index
sindresorhus/mimic-response
Mimic a Node.js HTTP response stream
JavaScript★ 61↓ 253M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
42At riskhealth index
jonschlinkert/fill-range
Fill in a range of numbers or letters, positive or negative, optionally passing an increment or multiplier to use.
JavaScript★ 60↓ 661M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
30At riskhealth index
jbgutierrez/path-parse
Node.js path.parse() ponyfill
JavaScript★ 57↓ 543M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
isaacs/wrappy
Callback wrapping utility
JavaScript★ 56Jul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
Packagist · npm
42At riskhealth index
archilex/filament-toggle-icon-column
A toggle icon column for Filament
PHP · Blade★ 55↓ 34.7K/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
34At riskhealth index
wesleytodd/setprototypeof
Polyfill for Object.setPrototypeOf
JavaScript★ 53↓ 450M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
npm
15Criticalhealth index
jonschlinkert/is-windows
Returns true if the platform is Windows (and Cygwin or MSYS/MinGW for unit tests)
JavaScript★ 48↓ 143M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist · npm
34At riskhealth index
m-a-k-o/nova-custom-table-card
Simple Nova Card for Custom Tables
PHP · Vue★ 45↓ 7,214/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
15Criticalhealth index
sindresorhus/path-is-absolute
Node.js 0.12 path.isAbsolute() ponyfill
JavaScript★ 43↓ 340M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
14Criticalhealth index
dominictarr/json-buffer
No repository description published.
JavaScript★ 41↓ 506M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Maven
21Criticalhealth index
yan74/afplib
JAVA Library for reading & writing AFP (Advanced Function Presentation) Files.
Java★ 41Jul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Packagist
19Criticalhealth index
symplify/phpstan-extensions
'ignore' error format, solid Symfony SplFileInfo and other useful extensions for PHPStan
PHP★ 39↓ 283.9K/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
TooTallNate/util-deprecate
The Node.js `util.deprecate()` function with browser support
JavaScript★ 37↓ 646M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
22Criticalhealth index
stefanpenner/get-caller-file
No repository description published.
TypeScript★ 37↓ 477M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
crates.io
25Criticalhealth index
jinko-core/jinko
Jinko is a small and safe interpreted language with fast Rust and C FFI
Rust★ 35Jul 24, 2026
GPL-2.0Jul 24, 2026 · metrics 1.13.0
npm
34At riskhealth index
jslicense/spdx-correct.js
correct invalid SPDX identifiers
JavaScript★ 35↓ 155M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Packagist
30At riskhealth index
umbrellio/laravel-ltree
LTree Extension (PostgreSQL) for Laravel
PHP★ 35↓ 3,360/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
27Criticalhealth index
A11yance/axobject-query
Programmatic access to information about the AXObject Model
JavaScript★ 34↓ 192M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
31At riskhealth index
kevva/astral-regex
Regular expression for matching astral symbols
JavaScript · TypeScript★ 34↓ 129M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
31At riskhealth index
calvinmetcalf/process-nextick-args
process.nextTick always accepts args, always
JavaScript★ 33↓ 348M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
17Criticalhealth index
humanwhocodes/object-schema
DEPRECATED. Use eslint/object-schema instead.
JavaScript★ 33↓ 137M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
npm
48At riskhealth index
bnjmnt4n/regjsgen
Generate regular expressions from regjsparser’s AST.
JavaScript★ 32↓ 154M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist · npm
28Criticalhealth index
kirschbaum-development/nova-comments
A commenting tool for Laravel Nova
PHP · Vue★ 32↓ 2,780/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
40At riskhealth index
infection/include-interceptor
Stream Wrapper: Include Interceptor. Allows to replace included (autoloaded) file with another one.
PHP★ 31↓ 1.1M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0