{"ecosystem":null,"ecosystem_label":null,"indexed_repositories":67020,"inspected_repositories":64794,"monthly_downloads":546216421839,"median_score":60,"share_good_or_better":0.4263,"computed_at":"2026-09-06T13:25:58.285816Z","bands":[{"band":"exceptional","repositories":3475,"monthly_downloads":79608852626},{"band":"excellent","repositories":10899,"monthly_downloads":88460015429},{"band":"good","repositories":13248,"monthly_downloads":82873405069},{"band":"moderate","repositories":16432,"monthly_downloads":99619503973},{"band":"weak","repositories":10607,"monthly_downloads":95909998503},{"band":"at_risk","repositories":7632,"monthly_downloads":88279502947},{"band":"critical","repositories":2501,"monthly_downloads":11465143292}],"histogram":[{"start":0,"count":124},{"start":5,"count":254},{"start":10,"count":650},{"start":15,"count":1473},{"start":20,"count":1535},{"start":25,"count":2605},{"start":30,"count":3492},{"start":35,"count":3395},{"start":40,"count":3161},{"start":45,"count":4051},{"start":50,"count":5991},{"start":55,"count":5227},{"start":60,"count":5214},{"start":65,"count":5145},{"start":70,"count":3217},{"start":75,"count":4886},{"start":80,"count":5039},{"start":85,"count":3767},{"start":90,"count":3640},{"start":95,"count":1928}],"categories":[{"key":"vitality","name":"Vitality","median":71,"record_median":null,"repositories":64796},{"key":"community","name":"Community & Adoption","median":46,"record_median":null,"repositories":64796},{"key":"governance","name":"Sustainability & Governance","median":59,"record_median":null,"repositories":64796},{"key":"engineering","name":"Engineering Quality","median":65,"record_median":null,"repositories":64796},{"key":"security","name":"Security","median":47,"record_median":null,"repositories":64796},{"key":"ai_readiness","name":"AI Readiness","median":53,"record_median":null,"repositories":64796}],"practices":[{"key":"readme","label":"README","share":0.9363,"repositories":64794},{"key":"license","label":"License detected","share":0.9078,"repositories":64794},{"key":"ci","label":"CI workflows","share":0.8098,"repositories":64794},{"key":"tests","label":"Automated tests","share":0.8494,"repositories":64794},{"key":"linter","label":"Linter configuration","share":0.4197,"repositories":64794},{"key":"docs_dir","label":"Documentation directory","share":0.3857,"repositories":64794},{"key":"contributing","label":"Contributing guide","share":0.3652,"repositories":64794},{"key":"security_policy","label":"Security policy","share":0.1867,"repositories":64794},{"key":"code_of_conduct","label":"Code of conduct","share":0.2281,"repositories":64794},{"key":"agent_instructions","label":"AI agent instructions","share":0.2364,"repositories":64794},{"key":"bootstrap","label":"One-command bootstrap","share":0.2864,"repositories":64794},{"key":"llms_txt","label":"llms.txt","share":0.0547,"repositories":64794}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":37985,"median_score":65},{"key":"user","label":"Personal accounts","repositories":26809,"median_score":53}],"bus_factor":[{"bucket":"1","repositories":48005},{"bucket":"2","repositories":9995},{"bucket":"3–5","repositories":5329},{"bucket":"6+","repositories":953}],"single_maintainer_share":0.7468,"single_maintainer_high_reliance":3765,"licenses":[{"license":"MIT","state":"standard","repositories":30169},{"license":"Apache-2.0","state":"standard","repositories":13402},{"license":null,"state":"custom","repositories":7021},{"license":null,"state":"absent","repositories":5973},{"license":"BSD-3-Clause","state":"standard","repositories":1980},{"license":"GPL-3.0","state":"standard","repositories":1670},{"license":"AGPL-3.0","state":"standard","repositories":1111},{"license":"MPL-2.0","state":"standard","repositories":685},{"license":"GPL-2.0","state":"standard","repositories":590},{"license":"BSD-2-Clause","state":"standard","repositories":534}],"ecosystems":[{"key":"npm","label":"npm","repositories":19605,"median_score":65,"monthly_downloads":471149541618,"share_good_or_better":0.5276,"bands":{"good":4456,"weak":2297,"at_risk":1700,"critical":537,"moderate":4727,"excellent":4333,"exceptional":1555}},{"key":"go","label":"Go","repositories":18170,"median_score":56,"monthly_downloads":1311673424,"share_good_or_better":0.3395,"bands":{"good":3046,"weak":3950,"at_risk":2648,"critical":539,"moderate":4865,"excellent":2355,"exceptional":767}},{"key":"pypi","label":"PyPI","repositories":9807,"median_score":69,"monthly_downloads":53485204861,"share_good_or_better":0.5654,"bands":{"good":2022,"weak":957,"at_risk":917,"critical":361,"moderate":2027,"excellent":2395,"exceptional":1128}},{"key":"packagist","label":"Packagist","repositories":7403,"median_score":57,"monthly_downloads":5166959356,"share_good_or_better":0.3332,"bands":{"good":1444,"weak":1527,"at_risk":653,"critical":114,"moderate":2642,"excellent":895,"exceptional":128}},{"key":"crates","label":"crates.io","repositories":5830,"median_score":67,"monthly_downloads":29476711004,"share_good_or_better":0.5362,"bands":{"good":1493,"weak":617,"at_risk":425,"critical":172,"moderate":1490,"excellent":1232,"exceptional":401}},{"key":"rubygems","label":"RubyGems","repositories":3149,"median_score":62,"monthly_downloads":1394398997,"share_good_or_better":0.4649,"bands":{"good":667,"weak":506,"at_risk":323,"critical":116,"moderate":740,"excellent":615,"exceptional":182}},{"key":"maven","label":"Maven","repositories":2224,"median_score":71,"monthly_downloads":996355307,"share_good_or_better":0.598,"bands":{"good":467,"weak":185,"at_risk":207,"critical":111,"moderate":391,"excellent":589,"exceptional":274}},{"key":"nuget","label":"NuGet","repositories":2177,"median_score":60,"monthly_downloads":5987219,"share_good_or_better":0.4437,"bands":{"good":531,"weak":357,"at_risk":219,"critical":82,"moderate":553,"excellent":360,"exceptional":75}},{"key":"hex","label":"Hex","repositories":1267,"median_score":51,"monthly_downloads":286531204,"share_good_or_better":0.2226,"bands":{"good":176,"weak":388,"at_risk":171,"critical":16,"moderate":410,"excellent":94,"exceptional":12}}],"top_repositories":[{"id":4630,"full_name":"typescript-eslint/typescript-eslint","url":"https://github.com/typescript-eslint/typescript-eslint","description":":sparkles: Monorepo for all the tooling which enables ESLint to support TypeScript","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript"],"topics":["typescript","eslint","eslint-plugin","tslint","eslintplugin","plugin","estree","ast","ecmascript","javascript","parser","syntax"],"license_spdx":"MIT","license_state":"standard","stars":16374,"forks":2978,"watchers":88,"monthly_downloads":3802611005,"latest_score":99,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T21:50:51.949769Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/typescript-eslint/typescript-eslint?v=a9f19ad7-1","icon_source_type":"homepage","badge_url":""},{"id":35120,"full_name":"npm/node-semver","url":"https://github.com/npm/node-semver","description":"The semver parser for node (the one npm uses)","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["npm-cli"],"license_spdx":"ISC","license_state":"standard","stars":5459,"forks":597,"watchers":99,"monthly_downloads":3519531457,"latest_score":90,"latest_band":"excellent","latest_scanned_at":"2026-08-29T15:30:37.849291Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/npm/node-semver?v=10fa8041-1","icon_source_type":"avatar","badge_url":""},{"id":35118,"full_name":"jridgewell/sourcemaps","url":"https://github.com/jridgewell/sourcemaps","description":"Monorepo for various sourcemap libraries","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript","JavaScript"],"topics":["source","map","remap","sourcemap","vlq"],"license_spdx":null,"license_state":"absent","stars":52,"forks":9,"watchers":3,"monthly_downloads":3343551524,"latest_score":53,"latest_band":"moderate","latest_scanned_at":"2026-08-29T15:19:05.820913Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/jridgewell/sourcemaps?v=425d335a-1","icon_source_type":"avatar","badge_url":""},{"id":12372,"full_name":"babel/babel","url":"https://github.com/babel/babel","description":"🐠 Babel is a compiler for writing next generation JavaScript.","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript","JavaScript"],"topics":["babel","javascript","ast","compiler","flavortown","es6","es2015","6to5","transpile","transpiler","babel-cli","classes","const","harmony","let","modules","var","babel-core","eslint","eslintplugin","eslint-plugin","babel-eslint","compat-table","compat-data","external-helpers"],"license_spdx":"MIT","license_state":"standard","stars":43987,"forks":5980,"watchers":827,"monthly_downloads":3312480697,"latest_score":98,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T21:50:18.001736Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/babel/babel?v=2e12d950-1","icon_source_type":"homepage","badge_url":""},{"id":35179,"full_name":"eslint/js","url":"https://github.com/eslint/js","description":"Monorepo for the JS language tools.","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["ast","ecmascript","javascript","parser","syntax","acorn","eslint"],"license_spdx":"BSD-2-Clause","license_state":"standard","stars":2387,"forks":233,"watchers":52,"monthly_downloads":3122054589,"latest_score":94,"latest_band":"exceptional","latest_scanned_at":"2026-08-29T15:31:40.049734Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/eslint/js?v=09c6270e-1","icon_source_type":"readme","badge_url":""},{"id":35125,"full_name":"isaacs/minimatch","url":"https://github.com/isaacs/minimatch","description":"a glob matcher in javascript","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript","TypeScript"],"topics":[],"license_spdx":"BlueOak-1.0.0","license_state":"standard","stars":3518,"forks":383,"watchers":58,"monthly_downloads":2931290995,"latest_score":77,"latest_band":"good","latest_scanned_at":"2026-08-29T15:30:55.075535Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/isaacs/minimatch?v=fd8fe35b-1","icon_source_type":"avatar","badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":43869,"median":54,"p25":41,"p75":69},{"label":"100 – 999","repositories":12362,"median":71,"p25":54,"p75":84},{"label":"1,000 – 9,999","repositories":6857,"median":83,"p25":63,"p75":91},{"label":"10,000 and more","repositories":1706,"median":92,"p25":81,"p75":96}],"popularity_downloads":[{"label":"Under 10K / month","repositories":12555,"median":59,"p25":47,"p75":71},{"label":"10K – 1M","repositories":10624,"median":67,"p25":53,"p75":81},{"label":"1M – 100M","repositories":4354,"median":75,"p25":51,"p75":89},{"label":"100M and more","repositories":1230,"median":53,"p25":36,"p75":80}],"freshness":[{"label":"Pushed within 30 days","repositories":50402},{"label":"31 – 90 days","repositories":4629},{"label":"91 – 365 days","repositories":4183},{"label":"Over a year","repositories":5580}],"median_days_since_push":3,"dependencies":{"basis":46991,"median_direct":3,"median_indirect":18,"median_total":26,"buckets":[{"label":"0","repositories":4953},{"label":"1 – 5","repositories":6363},{"label":"6 – 20","repositories":10621},{"label":"21 – 50","repositories":5413},{"label":"51 – 200","repositories":7134},{"label":"201 – 500","repositories":4517},{"label":"501 – 1,000","repositories":3748},{"label":"Over 1,000","repositories":4242}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":64136,"inconclusive_share":0.001},{"name":"Fuzzing","mean":0.6,"measured":64180,"inconclusive_share":0.0003},{"name":"Signed-Releases","mean":0.9,"measured":15334,"inconclusive_share":0.7611},{"name":"Branch-Protection","mean":1.3,"measured":48502,"inconclusive_share":0.2445},{"name":"SAST","mean":1.5,"measured":64144,"inconclusive_share":0.0008},{"name":"Pinned-Dependencies","mean":1.7,"measured":49412,"inconclusive_share":0.2303},{"name":"Token-Permissions","mean":1.8,"measured":48147,"inconclusive_share":0.25},{"name":"Code-Review","mean":2.1,"measured":63356,"inconclusive_share":0.0131},{"name":"Security-Policy","mean":2.5,"measured":64197,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":4.1,"measured":64197,"inconclusive_share":0.0},{"name":"Maintained","mean":5.4,"measured":64197,"inconclusive_share":0.0},{"name":"Contributors","mean":6.1,"measured":64195,"inconclusive_share":0.0},{"name":"CI-Tests","mean":6.4,"measured":47419,"inconclusive_share":0.2614},{"name":"Vulnerabilities","mean":6.6,"measured":64156,"inconclusive_share":0.0006},{"name":"License","mean":9.0,"measured":64196,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.7,"measured":48147,"inconclusive_share":0.25},{"name":"Binary-Artifacts","mean":9.8,"measured":64193,"inconclusive_share":0.0001},{"name":"Packaging","mean":10.0,"measured":17030,"inconclusive_share":0.7347}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":4222,"repositories":64797,"share":0.0652,"share_of_record":0.0652},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":1139,"repositories":57699,"share":0.0197,"share_of_record":0.0176},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":69,"repositories":27092,"share":0.0025,"share_of_record":0.0011},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":25,"repositories":1761,"share":0.0142,"share_of_record":0.0004}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[568,3462,3907,2951,3631,6253,10257,12289,11459,10019]},{"key":"community","name":"Community & Adoption","bins":[730,4281,9286,10419,11968,9277,7787,5767,3603,1678]},{"key":"governance","name":"Sustainability & Governance","bins":[9,426,1291,6201,7685,17016,16015,9921,5392,840]},{"key":"engineering","name":"Engineering Quality","bins":[387,794,2747,5345,6689,9536,13807,13404,8702,3385]},{"key":"security","name":"Security","bins":[425,1164,6470,13183,14457,13920,9441,4534,1074,128]},{"key":"ai_readiness","name":"AI Readiness","bins":[655,1896,5619,9075,11403,12229,10320,7352,5077,1170]}],"downloads_top1pct_share":0.691}