Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,474
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
649B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
npm
cure53/DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Apache-2.0Sep 16, 2026 · metrics 2.10.0
Maven
alibaba/DataX
DataX是阿里云DataWorks数据集成的开源版本。
Custom licenseSep 16, 2026 · metrics 2.10.0
Go
jeessy2/ddns-go
Simple and easy to use DDNS. Support Aliyun, Tencent Cloud, Dnspod, Cloudflare, Callback, Huawei Cloud, Baidu Cloud, Porkbun, GoDaddy, Namecheap, NameSilo...
MITSep 20, 2026 · metrics 2.10.0
npm
microsoft/react-native-windows
A framework for building native Windows apps with React.
Custom licenseSep 16, 2026 · metrics 2.10.0
npm
Effect-TS/effect
Build production-ready applications in TypeScript
MITOct 20, 2026 · metrics 2.10.0
PyPI
caronc/apprise
Apprise - Push Notifications that work with just about every platform!
BSD-2-ClauseSep 16, 2026 · metrics 2.10.0
Maven
questdb/questdb
QuestDB is a high performance, open-source, time-series database
Apache-2.0Sep 16, 2026 · metrics 2.10.0
crates.io
tursodatabase/libsql
libSQL is a fork of SQLite that is both Open Source, and Open Contributions.
MITOct 16, 2026 · metrics 2.10.0
npm
tradingview/lightweight-charts
Performant financial charts built with HTML5 canvas
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
networkx/networkx
Network Analysis in Python
Custom licenseSep 16, 2026 · metrics 2.10.0
PyPI
aws/aws-cli
Universal Command Line Interface for Amazon Web Services
Custom licenseSep 16, 2026 · metrics 2.10.0
npm · Packagist
koel/koel
Music streaming solution that works.
MITSep 16, 2026 · metrics 2.10.0
npm · Go
larksuite/cli
The official Lark/飞书 CLI tool, maintained by the larksuite team — built for humans and AI Agents. Covers core business domains including Messenger, Docs, Base, Sheets, Calendar, Mail, Tasks, Meetings, and more, with 200+ commands and 20+ AI Agent Skills.
MITSep 16, 2026 · metrics 2.10.0
Maven
neo4j/neo4j
Graphs for Everyone
GPL-3.0Sep 16, 2026 · metrics 2.10.0
Go
ent/ent
An entity framework for Go
Apache-2.0Oct 19, 2026 · metrics 2.10.0
npm
bvaughn/react-window
React components for efficiently rendering large lists and tabular data
MITSep 16, 2026 · metrics 2.10.0
npm · RubyGems
lottie-react-native/lottie-react-native
Lottie wrapper for React Native.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
—
tigerbeetle/tigerbeetle
The financial transactions database designed for mission critical safety and performance.
Apache-2.0Oct 12, 2026 · metrics 2.10.0
Go
ipfs/kubo
IPFS implementation in Go: a daemon that stores and serves content-addressed data, with a CLI, HTTP Gateway, and RPC API
Custom licenseOct 9, 2026 · metrics 2.10.0
Maven
ceph/ceph
Ceph is a distributed object, block, and file storage platform
Custom licenseOct 19, 2026 · metrics 2.10.0
Go
julienschmidt/httprouter
A high performance HTTP request router that scales well
BSD-3-ClauseSep 15, 2026 · metrics 2.10.0
PyPI · RubyGems
apache/arrow
Apache Arrow is the universal columnar format and multi-language toolbox for fast data interchange and in-memory analytics
Apache-2.0Sep 17, 2026 · metrics 2.10.0
PyPI
QwenLM/Qwen-Agent
Agent framework and applications built upon Qwen>=3.0, featuring Function Calling, MCP, Code Interpreter, RAG, Chrome extension, etc.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
npm
sindresorhus/ky
🌳 Tiny & elegant JavaScript HTTP client based on the Fetch API
MITSep 17, 2026 · metrics 2.10.0
npm
less/less.js
Less. The dynamic stylesheet language.
Apache-2.0Sep 16, 2026 · metrics 2.10.0
npm
vitest-dev/vitest
Next generation testing framework powered by Vite.
MITAug 27, 2026 · metrics 2.10.0
Go · npm · PyPI
argoproj/argo-workflows
Workflow Engine for Kubernetes
Apache-2.0Sep 17, 2026 · metrics 2.10.0
Go · npm
hashicorp/nomad
Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. Nomad is easy to operate and scale and has native Consul and Vault integrations.
Custom licenseSep 24, 2026 · metrics 2.10.0
npm
video-dev/hls.js
HLS.js is a JavaScript library that plays HLS in browsers with support for MSE.
Custom licenseSep 16, 2026 · metrics 2.10.0
PyPI
wazuh/wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Custom licenseSep 20, 2026 · metrics 2.10.0