Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

↗

Reproducible evidenceEvery published result links to inspectable source evidence and methodology.

◇

Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.

≈

Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.

Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories

36,924

Monthly downloads under inspection

379B

Median health index

57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth

Clear filters

364 recordsRanked by popularity · browse by tag · record statistics

npm

20Criticalhealth index

ampproject/remapping

Remap sequential sourcemaps through transformations to point at the original source code

TypeScript · JavaScript★ 137↓ 141M/moJul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

npm

34At riskhealth index

istanbuljs/v8-to-istanbul

convert from v8 coverage format to istanbul's format

JavaScript★ 137↓ 173M/moJul 22, 2026

ISCJul 22, 2026 · metrics 1.13.0

npm

38At riskhealth index

sindresorhus/arrify

Convert a value to an array

TypeScript · JavaScript★ 133↓ 182M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm · Maven

28Criticalhealth index

shimohq/react-native-prompt-android

A polyfill library for Alert.prompt on Android platform, working both on Android and iOS platform.

Java · JavaScript · Objective-C★ 130↓ 28K/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

25Criticalhealth index

defunctzombie/node-process

process information for node.js and browsers

JavaScript★ 129Jul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

43At riskhealth index

chaijs/type-detect

Improved typeof detection for node.js and the browser.

JavaScript · TypeScript★ 128↓ 252M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

25Criticalhealth index

estools/esutils

utility box for ECMAScript language tools

CoffeeScript · JavaScript★ 123↓ 570M/moJul 22, 2026

BSD-2-ClauseJul 22, 2026 · metrics 1.13.0

npm

24Criticalhealth index

feross/ieee754

Read/write IEEE754 floating point numbers from/to a Buffer or array-like object.

JavaScript★ 121↓ 405M/moJul 22, 2026

BSD-3-ClauseJul 22, 2026 · metrics 1.13.0

npm

38At riskhealth index

octokit/auth-token.js

GitHub API token authentication for browsers and Node.js

TypeScript · JavaScript★ 121↓ 128M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

26Criticalhealth index

oceanprotocol/ocean.js

🦑 Ocean Protocol JavaScript library to privately & securely publish, exchange, and consume data.

TypeScript★ 118↓ 6,692/moJul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

npm

38At riskhealth index

sindresorhus/is-interactive

Check if stdout or stderr is interactive

JavaScript · TypeScript★ 118↓ 250M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

—

29Criticalhealth index

StackStorm/stackstorm-k8s

K8s Helm Chart that codifies StackStorm (aka "IFTTT for Ops" https://stackstorm.com/) Highly Availability fleet as a simple to use reproducible infrastructure-as-code app

Smarty · Shell★ 114Jul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

npm

37At riskhealth index

jsdom/js-symbol-tree

Turn any collection of objects into its own efficient tree or linked list using Symbol

JavaScript★ 113↓ 263M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

34At riskhealth index

jonschlinkert/normalize-path

Normalize file path slashes to be unix-like forward slashes. Used by chokidar, anymatch, and many others!

JavaScript★ 112↓ 583M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

33At riskhealth index

WebReflection/html-escaper

A module to escape/unescape common problematic entities done the right way.

JavaScript★ 111↓ 316M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

27Criticalhealth index

JoshGlazebrook/smart-buffer

smart-buffer is a Buffer wrapper that adds automatic read & write offset tracking, string operations, data insertions, and more.

TypeScript★ 108↓ 260M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

36At riskhealth index

jonschlinkert/isobject

Is the value an object, and not an array or null?

JavaScript★ 107↓ 243M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

30At riskhealth index

pyth-network/pyth-client-js

Javascript API for on-chain pyth account structure

TypeScript★ 106↓ 117.8K/moJul 22, 2026

Apache-2.0Jul 22, 2026 · metrics 1.13.0

npm

39At riskhealth index

sindresorhus/is-plain-obj

Check if a value is a plain object

JavaScript · TypeScript★ 106↓ 442M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

PyPI

18Criticalhealth index

intel/torch-ccl

oneCCL Bindings for Pytorch* (deprecated)

C++ · Python★ 104Jul 23, 2026

BSD-3-ClauseJul 23, 2026 · metrics 1.13.0

npm

27Criticalhealth index

jensyt/imurmurhash-js

An incremental implementation of MurmurHash3 for JavaScript

JavaScript★ 104↓ 645M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

26Criticalhealth index

epoberezkin/json-schema-traverse

Traverse JSON Schema passing each schema object to callback

JavaScript★ 103↓ 1.1B/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

48At riskhealth index

jshttp/compressible

Compressible Content-Type / mime checking.

JavaScript★ 103↓ 147M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

crates.io

18Criticalhealth index

servo/heapsize

In support of measuring heap allocations in Rust programs.

Rust★ 103↓ 72.5K/moJul 23, 2026

Apache-2.0Jul 23, 2026 · metrics 1.13.0

npm

25Criticalhealth index

browserify/randombytes

random bytes from browserify stand alone

JavaScript★ 102↓ 145M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

28Criticalhealth index

brianloveswords/buffer-crc32

A pure javascript CRC32 algorithm that plays nice with binary data

JavaScript★ 100↓ 261M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

Packagist

25Criticalhealth index

Nyholm/psr7-server

Helper classes to use any PSR7 implementation as your main request and response

PHP★ 96↓ 2.3M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

37At riskhealth index

sindresorhus/has-flag

Check if argv has a specific flag

JavaScript · TypeScript★ 96↓ 1.1B/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

14Criticalhealth index

loganfsmyth/gensync

Allows users to use generators in order to write common functions that can be both sync or async.

JavaScript★ 95↓ 495M/moJul 22, 2026

MITJul 22, 2026 · metrics 1.13.0

npm

19Criticalhealth index

mpfast/TaroCreator

微信小程序小程序模板小程序可视化设计工具 Taro Taro UI

Vue · SCSS★ 94Jul 23, 2026

MITJul 23, 2026 · metrics 1.13.0

01Vitality 02Community & adoption 03Governance 04Engineering quality 05Security posture 06AI readiness

A public record of software health.

Request a scan

The record, as it stands.

Red flags