Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,633
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
436 recordsRanked by popularity · browse by tag · record statistics
npm
30At riskhealth index
emilbayes/siginfo
Utility module to print pretty messages on SIGINFO/SIGUSR1
JavaScript★ 30↓ 225M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
npm
19Criticalhealth index
humanwhocodes/config-array
DEPRECATED. Use eslint/config-array instead
JavaScript★ 30↓ 148M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
—
23Criticalhealth index
kwonoj/protobuf-wasm
No repository description published.
Mixed★ 30Jul 24, 2026
No licenseJul 24, 2026 · metrics 1.13.0
—
28Criticalhealth index
sparkfun/SparkFun_Apollo3_AmbiqSuite_BSPs
One-stop-shop for all your AmbiqSuite SDK board support package needs.
C · Makefile★ 29Jul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
ChALkeR/safer-buffer
Modern Buffer API polyfill without footguns
JavaScript★ 27↓ 618M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
37At riskhealth index
eventualbuddha/lines-and-columns
Maps lines and columns to character offsets and back.
TypeScript★ 27↓ 526M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
13Criticalhealth index
jsdom/whatwg-encoding
Decode strings according to the WHATWG Encoding Standard
Mixed★ 27Jul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
22Criticalhealth index
visual-framework/vf-core
A (primarily CSS) framework that targets needs of life science websites and services
Nunjucks · JavaScript · SCSS★ 27↓ 10.7K/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
39At riskhealth index
humanwhocodes/module-importer
Universal importer for CommonJS and ESM in Node.js
JavaScript★ 26↓ 410M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Packagist
36At riskhealth index
infection/extension-installer
Infection Extension Installer (autodiscovery of Infection extensions)
PHP★ 26↓ 1.1M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
—
22Criticalhealth index
julia-vscode/SymbolServer.jl
No repository description published.
Julia★ 26Jul 24, 2026
Custom licenseJul 24, 2026 · metrics 1.13.0
—
28Criticalhealth index
adshao/brc-721
BRC-721: Non-Fungible Tokens on the Bitcoin Network
Mixed★ 25Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
arcanis/jest-pnp-resolver
Transparently adds support for Plug'n'Play to Jest
JavaScript★ 25↓ 163M/moJul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
crates.io
31At riskhealth index
wasix-org/static-web-server
A blazing fast and asynchronous web server for static files-serving. ⚡
Rust★ 25Jul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0
npm
29Criticalhealth index
knownasilya/cli-width
Fallback to a default if `process.stdout.getWindowSize` doesn't exist
JavaScript★ 24↓ 269M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
npm
33At riskhealth index
micromatch/is-extglob
Returns true if a string has an extglob
JavaScript★ 23Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
18Criticalhealth index
iam-medvedev/chrome-devtools
Automated Chrome DevTools frontend builder
JavaScript★ 22↓ 522/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
39At riskhealth index
jsdom/w3c-xmlserializer
An XML serializer that follows the W3C specification.
JavaScript★ 22↓ 281M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
hughsk/is-typedarray
Detect whether or not an object is a Typed Array
JavaScript★ 21↓ 138M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
—
16Criticalhealth index
EVerest/libslac
Simple ISO15118-3 SLAC implementation
C++★ 19Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
npm
33At riskhealth index
wooorm/zwitch
Handle values based on a property
JavaScript · TypeScript★ 17↓ 175M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
cspotcode/node-source-map-support
Adds source map support to node.js (for stack traces)
JavaScript★ 16↓ 189M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
20Criticalhealth index
WalletConnect/auth-client-js
No repository description published.
TypeScript★ 15↓ 52.1K/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
StenaIT/stenajs-webui
A collection of React components and hooks
TypeScript★ 14↓ 31K/moJul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
11Criticalhealth index
defunctzombie/node-stackback
return array of v8 CallSite objects for a stacktrace
JavaScript★ 14Jul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
—
22Criticalhealth index
flipperdevices/stm32wb_copro
No repository description published.
C++ · C★ 14Jul 23, 2026
No licenseJul 23, 2026 · metrics 1.13.0
—
29Criticalhealth index
initCommerce/gato
A dart utility library inspired by javascript lodash library.
Dart★ 13Jul 24, 2026
MITJul 24, 2026 · metrics 1.13.0