Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,668
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
1,628 recordsRanked by popularity · browse by tag · record statistics
PyPI
22Criticalhealth index
python-lsp/python-lsp-jsonrpc
Fork of the python-jsonrpc-server project, maintained by the Spyder IDE team and the community
Python★ 28Jul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
Packagist
30At riskhealth index
yiisoft/network-utilities
Network related utilities
PHP★ 28↓ 20.9K/moJul 20, 2026
BSD-3-ClauseJul 20, 2026 · metrics 1.13.0
npm
26Criticalhealth index
ChALkeR/safer-buffer
Modern Buffer API polyfill without footguns
JavaScript★ 27↓ 618M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
38At riskhealth index
JBZoo/Event
The EventEmitter is a simple pattern that allows you to create an object that emits events, and allow you to listen to those events.
PHP★ 27↓ 8,079/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
34At riskhealth index
Laravel-Lang/attributes
Translation of form element names
PHP★ 27↓ 208.8K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
12Criticalhealth index
antigenomics/tcren
Predicting TCR:pMHC binding from structural data
Jupyter Notebook · Python★ 27↓ 2,183/moJul 19, 2026
GPL-3.0Jul 19, 2026 · metrics 1.13.0
npm
26Criticalhealth index
electerm/electerm-locales
Multi language files for electerm
JavaScript★ 27↓ 5,204/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
npm
37At riskhealth index
eventualbuddha/lines-and-columns
Maps lines and columns to character offsets and back.
TypeScript★ 27↓ 526M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
—
13Criticalhealth index
jsdom/whatwg-encoding
Decode strings according to the WHATWG Encoding Standard
Mixed★ 27Jul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
Packagist
36At riskhealth index
mezzio/mezzio-problem-details
Problem Details for PSR-7 HTTP APIs addressing the RFC 7807 standard
PHP★ 27↓ 26.5K/moJul 24, 2026
BSD-3-ClauseJul 24, 2026 · metrics 1.13.0
Go
34At riskhealth index
paketo-buildpacks/builder-jammy-base
A Cloud Native Buildpacks (CNB) builder with the Paketo Jammy Jellyfish Base stack and Paketo buildpacks.
Go · Shell★ 27Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
npm
22Criticalhealth index
visual-framework/vf-core
A (primarily CSS) framework that targets needs of life science websites and services
Nunjucks · JavaScript · SCSS★ 27↓ 10.7K/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Packagist
32At riskhealth index
yiisoft/csrf
PSR-15 middleware implementing CSRF protection
PHP★ 27↓ 13.1K/moJul 20, 2026
BSD-3-ClauseJul 20, 2026 · metrics 1.13.0
Packagist
30At riskhealth index
yiisoft/i18n
Yii i18n
PHP★ 27↓ 31.5K/moJul 20, 2026
BSD-3-ClauseJul 20, 2026 · metrics 1.13.0
crates.io
26Criticalhealth index
cavivie/netstack-smoltcp
A netstack based on smoltcp-rs.
Rust · Shell★ 26↓ 27.4K/moJul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Go
8Criticalhealth index
foxcpp/go-imap-sql
SQL-based storage backend for go-imap v2
Go★ 26Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
Go
17Criticalhealth index
grafana-cold-storage/xk6-amqp
A k6 extension for publishing and consuming messages from queues and exchanges using AMQP 0.9.1.
Go★ 26Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
npm
30At riskhealth index
gravity-ui/table
No repository description published.
TypeScript★ 26↓ 31.7K/moJul 19, 2026
MITJul 19, 2026 · metrics 1.13.0
npm
39At riskhealth index
humanwhocodes/module-importer
Universal importer for CommonJS and ESM in Node.js
JavaScript★ 26↓ 410M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Packagist
36At riskhealth index
infection/extension-installer
Infection Extension Installer (autodiscovery of Infection extensions)
PHP★ 26↓ 1.1M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
—
22Criticalhealth index
julia-vscode/SymbolServer.jl
No repository description published.
Julia★ 26Jul 24, 2026
Custom licenseJul 24, 2026 · metrics 1.13.0
npm
33At riskhealth index
taiga-family/toolkit
ESlint, Stylelint, Prettier and more tools
TypeScript★ 26Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Packagist
32At riskhealth index
yiisoft/translator
Message translation
PHP★ 26↓ 30.2K/moJul 20, 2026
BSD-3-ClauseJul 20, 2026 · metrics 1.13.0
—
28Criticalhealth index
adshao/brc-721
BRC-721: Non-Fungible Tokens on the Bitcoin Network
Mixed★ 25Jul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
29Criticalhealth index
arcanis/jest-pnp-resolver
Transparently adds support for Plug'n'Play to Jest
JavaScript★ 25↓ 163M/moJul 22, 2026
No licenseJul 22, 2026 · metrics 1.13.0
npm
31At riskhealth index
gravity-ui/websql-autocomplete
A tool that provides autocompletion for various sql dialects
TypeScript★ 25↓ 11.6K/moJul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Packagist
22Criticalhealth index
voku/urlify
🔗 URLify - Convert any string into a valid and readable string for usage in the URL.
PHP★ 25↓ 50.3K/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
crates.io
31At riskhealth index
wasix-org/static-web-server
A blazing fast and asynchronous web server for static files-serving. ⚡
Rust★ 25Jul 24, 2026
Apache-2.0Jul 24, 2026 · metrics 1.13.0