Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,372
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
393 recordsRanked by popularity · browse by tag · record statistics
npm
37At riskhealth index
eventualbuddha/lines-and-columns
Maps lines and columns to character offsets and back.
TypeScript★ 27↓ 526M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
13Criticalhealth index
jsdom/whatwg-encoding
Decode strings according to the WHATWG Encoding Standard
Mixed★ 27Jul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
22Criticalhealth index
visual-framework/vf-core
A (primarily CSS) framework that targets needs of life science websites and services
Nunjucks · JavaScript · SCSS★ 27↓ 10.7K/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
39At riskhealth index
humanwhocodes/module-importer
Universal importer for CommonJS and ESM in Node.js
JavaScript★ 26↓ 410M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Packagist
36At riskhealth index
infection/extension-installer
Infection Extension Installer (autodiscovery of Infection extensions)
PHP★ 26↓ 1.1M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
—
22Criticalhealth index
julia-vscode/SymbolServer.jl
No repository description published.
Julia★ 26Jul 24, 2026
Custom licenseJul 24, 2026 · metrics 1.13.0
—
28Criticalhealth index
adshao/brc-721
BRC-721: Non-Fungible Tokens on the Bitcoin Network
Mixed★ 25Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
arcanis/jest-pnp-resolver
Transparently adds support for Plug'n'Play to Jest
JavaScript★ 25↓ 163M/moJul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
knownasilya/cli-width
Fallback to a default if `process.stdout.getWindowSize` doesn't exist
JavaScript★ 24↓ 269M/moJul 22, 2026
ISCJul 22, 2026 · metrics 1.13.0
npm
33At riskhealth index
micromatch/is-extglob
Returns true if a string has an extglob
JavaScript★ 23Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
18Criticalhealth index
iam-medvedev/chrome-devtools
Automated Chrome DevTools frontend builder
JavaScript★ 22↓ 522/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
39At riskhealth index
jsdom/w3c-xmlserializer
An XML serializer that follows the W3C specification.
JavaScript★ 22↓ 281M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
hughsk/is-typedarray
Detect whether or not an object is a Typed Array
JavaScript★ 21↓ 138M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
—
16Criticalhealth index
EVerest/libslac
Simple ISO15118-3 SLAC implementation
C++★ 19Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
npm
33At riskhealth index
wooorm/zwitch
Handle values based on a property
JavaScript · TypeScript★ 17↓ 175M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
26Criticalhealth index
cspotcode/node-source-map-support
Adds source map support to node.js (for stack traces)
JavaScript★ 16↓ 189M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
20Criticalhealth index
WalletConnect/auth-client-js
No repository description published.
TypeScript★ 15↓ 52.1K/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
StenaIT/stenajs-webui
A collection of React components and hooks
TypeScript★ 14↓ 31K/moJul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
11Criticalhealth index
defunctzombie/node-stackback
return array of v8 CallSite objects for a stacktrace
JavaScript★ 14Jul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
—
22Criticalhealth index
flipperdevices/stm32wb_copro
No repository description published.
C++ · C★ 14Jul 23, 2026
No licenseJul 23, 2026 · metrics 1.13.0
npm
27Criticalhealth index
samn/json-stable-stringify
deterministic JSON.stringify() with custom sorting to get deterministic hashes from stringified results
JavaScript★ 13↓ 508M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
PyPI
22Criticalhealth index
astronomer/astro-airflow-mcp
MCP server for Apache Airflow instances. Runs standalone or as an Airflow plugin.
Python★ 12Jul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0
Packagist
42At riskhealth index
marineusde/larapex-charts
A Laravel wrapper for apex charts
PHP★ 12↓ 3,491/moJul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
npm
33At riskhealth index
wooorm/bail
Throw if given an error
JavaScript · TypeScript★ 12↓ 169M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
15Criticalhealth index
CycloneDX/cdxgen-action
GitHub action for CycloneDX BOM generator (cdxgen). cdxgen produced bom xml file can be uploaded to dependency track, AppThreat and other commercial Software Composition Analysis (SCA) products
JavaScript★ 11Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
30At riskhealth index
composer-unused/contracts
Contract repository for composer-unused
PHP★ 11↓ 380.9K/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
32At riskhealth index
shikijs/vscode-textmate
Shiki's fork of `vscode-textmate`
TypeScript★ 11↓ 61.5M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0