Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,554
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
649B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
Go
xanzy/go-gitlab
GitLab Go SDK
Apache-2.0Oct 19, 2026 · metrics 2.10.0
npm
yomotsu/camera-controls
A camera control for three.js, similar to THREE.OrbitControls yet supports smooth transitions and more features.
MITSep 17, 2026 · metrics 2.10.0
PyPI
jameslyons/python_speech_features
This library provides common speech features for ASR including MFCCs and filterbank energies.
MITSep 17, 2026 · metrics 2.10.0
Go
vmware-archive/kubewatch
Watch k8s events and trigger Handlers
Apache-2.0Sep 24, 2026 · metrics 2.10.0
Packagist
php-pds/skeleton
Standard PHP package skeleton.
CC-BY-SA-4.0Sep 16, 2026 · metrics 2.10.0
Packagist
TruCopilot/phpfastcache
A high-performance backend cache system. It is intended for use in speeding up dynamic web applications by alleviating database load. Well implemented, it can drops the database load to almost nothing, yielding faster page load times for users, better resource utilization. It is simple yet powerful.
MITOct 1, 2026 · metrics 2.10.0
npm
Andarist/react-textarea-autosize
<textarea /> component for React which grows with content
MITSep 17, 2026 · metrics 2.10.0
npm
coopernurse/node-pool
Generic resource pooling for node.js
No licenseSep 17, 2026 · metrics 2.10.0
npm
blakeembrey/change-case
Convert strings between camelCase, PascalCase, Capital Case, snake_case and more
MITSep 17, 2026 · metrics 2.10.0
npm · PyPI
lshqqytiger/stable-diffusion-webui-amdgpu
Stable Diffusion web UI
AGPL-3.0Sep 13, 2026 · metrics 2.10.0
NuGet
neuecc/Utf8Json
Definitely Fastest and Zero Allocation JSON Serializer for C#(NET, .NET Core, Unity, Xamarin).
MITSep 14, 2026 · metrics 2.10.0
—
OneGet/oneget
PackageManagement (aka OneGet) is a package manager for Windows
MITSep 13, 2026 · metrics 2.10.0
npm
webpack/webpack-hot-middleware
Webpack hot reloading you can attach to your own server
MITSep 17, 2026 · metrics 2.10.0
npm
node-cache/node-cache
a node internal (in-memory) caching module
MITSep 17, 2026 · metrics 2.10.0
PyPI
JelteF/PyLaTeX
A Python library for creating LaTeX files
MITSep 17, 2026 · metrics 2.10.0
npm
Comfy-Org/desktop
[ARCHIVED] Superseded by https://github.com/Comfy-Org/Comfy-Desktop
GPL-3.0Sep 20, 2026 · metrics 2.10.0
PyPI
ethereum/py-evm
A Python implementation of the Ethereum Virtual Machine
MITSep 17, 2026 · metrics 2.10.0
Go
hashicorp/go-retryablehttp
Retryable HTTP client in Go
MPL-2.0Sep 14, 2026 · metrics 2.10.0
npm
db-migrate/node-db-migrate
Database migration framework for node
Custom licenseSep 9, 2026 · metrics 2.10.0
Packagist
sebastianbergmann/phploc
A tool for quickly measuring the size of a PHP project.
BSD-3-ClauseSep 18, 2026 · metrics 2.10.0
PyPI
langchain-ai/langserve
LangServe 🦜️🏓
Custom licenseSep 17, 2026 · metrics 2.10.0
PyPI
nschloe/meshio
:spider_web: input/output for many mesh formats
MITSep 14, 2026 · metrics 2.10.0
PyPI
google-gemini/deprecated-generative-ai-python
This SDK is now deprecated, use the new unified Google GenAI SDK.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Maven
HdrHistogram/HdrHistogram
A High Dynamic Range (HDR) Histogram
Custom licenseSep 14, 2026 · metrics 2.10.0
Go
chzyer/readline
Readline is a pure go(golang) implementation for GNU-Readline kind library
MITOct 21, 2026 · metrics 2.10.0
PyPI
fastapiutils/fastapi-utils
Reusable utilities for FastAPI
MITSep 17, 2026 · metrics 2.10.0
PyPI
pyusb/pyusb
Easy USB access for Python
BSD-3-ClauseSep 12, 2026 · metrics 2.10.0
PyPI
sevagas/macro_pack
macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents, VB scripts, shortcuts, and other formats for pentest, demo, and social engineering assessments. The goal of macro_pack is to simplify exploitation, antimalware bypass, and automatize the process from malicious macro and script generation to final document generation. It also provides a lot of helpful features useful for redteam or security research.
Apache-2.0Oct 21, 2026 · metrics 2.10.0
PyPI
seb-m/pyinotify
Monitoring filesystems events with inotify on Linux.
MITSep 17, 2026 · metrics 2.10.0
npm
Automattic/cli-table
Pretty unicode tables for the CLI with Node.JS
MITSep 17, 2026 · metrics 2.10.0