Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
36,863
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
380 recordsRanked by popularity · browse by tag · record statistics
—
20Criticalhealth index
relevance/rcov
The new home of RCov on GitHub
Ruby★ 407Jul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
37At riskhealth index
mathiasbynens/regenerate
Generate JavaScript-compatible regular expressions based on a given set of Unicode symbols or code points.
JavaScript★ 378↓ 157M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
25Criticalhealth index
creationix/jsonparse
A streaming JSON parser written in pure JavaScript for node.js
JavaScript★ 370↓ 84M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
pkrumins/node-tree-kill
kill trees of processes
JavaScript★ 359↓ 175M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
20Criticalhealth index
trezor/trezor-core
:lock: Don't use this repo, use the new monorepo instead:
Python · C★ 358Jul 23, 2026
GPL-3.0Jul 23, 2026 · metrics 1.13.0
npm
27Criticalhealth index
jonschlinkert/kind-of
Get the native JavaScript type of a value, fast. Used by superstruct, micromatch and many others!
JavaScript★ 354↓ 482M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
feross/safe-buffer
Safer Node.js Buffer API
JavaScript★ 350↓ 1.1B/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
43At riskhealth index
shajidhasan/spoilerjs
A framework-agnostic web component for creating beautiful spoiler effects with Telegram-inspired particle animations.
Svelte · TypeScript★ 340↓ 2,022/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
dougwilson/nodejs-depd
Deprecate all the things
JavaScript★ 329↓ 499M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
25Criticalhealth index
kframework/c-semantics
Semantics of C in K
C · OCaml★ 328Jul 23, 2026
Custom licenseJul 23, 2026 · metrics 1.13.0
npm
22Criticalhealth index
epoberezkin/fast-json-stable-stringify
Deterministic JSON.stringify() - a faster version of @substack's json-stable-strigify without jsonify.
JavaScript★ 322↓ 586M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
garycourt/uri-js
An RFC 3986 compliant, scheme extendable URI parsing/validating/normalizing/resolving library for JavaScript
JavaScript · TypeScript★ 317↓ 573M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
jonschlinkert/clone-deep
Recursively (deep) clone JavaScript native types, like Object, Array, RegExp, Date as well as primitives. Used by superstruct, merge-deep, and many others!
JavaScript★ 317↓ 110M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
20Criticalhealth index
polaris-gslb/polaris-gslb
A free, open source GSLB (Global Server Load Balancing) solution.
Python★ 312Jul 23, 2026
Custom licenseJul 23, 2026 · metrics 1.13.0
PyPI
17Criticalhealth index
trezor/trezor-mcu
:lock: Don't use this repo, use the new monorepo instead:
C★ 312Jul 23, 2026
LGPL-3.0Jul 23, 2026 · metrics 1.13.0
npm
25Criticalhealth index
webpack/loader-runner
Runs (webpack) loaders
JavaScript★ 307↓ 182M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
16Criticalhealth index
Raynos/xtend
extend like a boss
JavaScript★ 306↓ 298M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
7Criticalhealth index
floatdrop/require-from-string
Load module from string
JavaScript★ 298↓ 452M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
24Criticalhealth index
IntersectMBO/plutus-apps
The Plutus application platform
Haskell★ 297Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
npm
24Criticalhealth index
publishlab/node-acme-client
Simple and unopinionated ACME client for Node.js
JavaScript★ 295↓ 567.7K/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
Maven · npm · RubyGems
27Criticalhealth index
wuba/taro-playground
The Taro Playground App is a cross-platform application developed using Taro, to help developers develop and debug Taro applications.
TypeScript★ 293Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
NuGet
23Criticalhealth index
MizunagiKB/gd_cubism
Unofficial Live2D Player for Godot Engine
C++ · CSS★ 289Jul 23, 2026
Custom licenseJul 23, 2026 · metrics 1.13.0
npm
47At riskhealth index
ehmicky/human-signals
Human-friendly process signals
JavaScript · TypeScript★ 286↓ 513M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
23Criticalhealth index
jonschlinkert/is-number
JavaScript/Node.js utility. Returns `true` if the value is a number or string number. Useful for checking regex match results, user input, parsed strings, etc.
JavaScript★ 284↓ 714M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
zertosh/loose-envify
Like envify but much faster
JavaScript★ 283↓ 434M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
20Criticalhealth index
then/is-promise
Test whether an object looks like a promises-a+ promise
JavaScript★ 282↓ 256M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
43At riskhealth index
pycroscopy/pycroscopy
Scientific analysis of nanoscale materials imaging data
Jupyter Notebook★ 279Jul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
RubyGems
26Criticalhealth index
defunkt/colored
Colors in your terminal. Unmaintained.
Ruby★ 274Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
23Criticalhealth index
ARM-software/SCP-firmware
This System Control Processor (SCP) firmware repository is no longer used and has been set to Read-only for archiving purposes. Please refer to the following active repository.
C★ 265Jul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
—
21Criticalhealth index
timescale/helm-charts
Configuration and Documentation to run TimescaleDB in your Kubernetes cluster
Shell · Smarty · Mustache★ 262Jul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0