{"ecosystem":"crates","ecosystem_label":"crates.io","indexed_repositories":2549,"inspected_repositories":2549,"monthly_downloads":12738494193,"median_score":62,"share_good_or_better":0.264,"computed_at":"2026-07-23T17:20:11.695678Z","bands":[{"band":"excellent","repositories":49,"monthly_downloads":823770965},{"band":"good","repositories":624,"monthly_downloads":5522887916},{"band":"moderate","repositories":1428,"monthly_downloads":4981407178},{"band":"at_risk","repositories":374,"monthly_downloads":1342433372},{"band":"critical","repositories":74,"monthly_downloads":67994762}],"histogram":[{"start":0,"count":0},{"start":5,"count":1},{"start":10,"count":12},{"start":15,"count":19},{"start":20,"count":17},{"start":25,"count":25},{"start":30,"count":47},{"start":35,"count":65},{"start":40,"count":101},{"start":45,"count":161},{"start":50,"count":289},{"start":55,"count":373},{"start":60,"count":413},{"start":65,"count":353},{"start":70,"count":296},{"start":75,"count":213},{"start":80,"count":115},{"start":85,"count":46},{"start":90,"count":3},{"start":95,"count":0}],"categories":[{"key":"vitality","name":"Vitality","median":79,"record_median":73,"repositories":2549},{"key":"community","name":"Community & Adoption","median":55,"record_median":46,"repositories":2549},{"key":"governance","name":"Sustainability & Governance","median":62,"record_median":59,"repositories":2549},{"key":"engineering","name":"Engineering Quality","median":66,"record_median":66,"repositories":2549},{"key":"security","name":"Security","median":48,"record_median":45,"repositories":2549},{"key":"ai_readiness","name":"AI Readiness","median":50,"record_median":46,"repositories":2549}],"practices":[{"key":"readme","label":"README","share":0.9576,"repositories":2549},{"key":"license","label":"License detected","share":0.9392,"repositories":2549},{"key":"ci","label":"CI workflows","share":0.9498,"repositories":2549},{"key":"tests","label":"Automated tests","share":0.8372,"repositories":2549},{"key":"linter","label":"Linter configuration","share":0.2401,"repositories":2549},{"key":"docs_dir","label":"Documentation directory","share":0.4296,"repositories":2549},{"key":"contributing","label":"Contributing guide","share":0.3896,"repositories":2549},{"key":"security_policy","label":"Security policy","share":0.2287,"repositories":2549},{"key":"code_of_conduct","label":"Code of conduct","share":0.2236,"repositories":2549},{"key":"agent_instructions","label":"AI agent instructions","share":0.3095,"repositories":2549},{"key":"bootstrap","label":"One-command bootstrap","share":0.3452,"repositories":2549},{"key":"llms_txt","label":"llms.txt","share":0.0247,"repositories":2549}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":1505,"median_score":65},{"key":"user","label":"Personal accounts","repositories":1044,"median_score":57}],"bus_factor":[{"bucket":"1","repositories":1849},{"bucket":"2","repositories":391},{"bucket":"3–5","repositories":239},{"bucket":"6+","repositories":66}],"single_maintainer_share":0.7265,"single_maintainer_high_reliance":199,"licenses":[{"license":"Apache-2.0","state":"standard","repositories":981},{"license":"MIT","state":"standard","repositories":901},{"license":null,"state":"custom","repositories":263},{"license":null,"state":"absent","repositories":155},{"license":"GPL-3.0","state":"standard","repositories":55},{"license":"AGPL-3.0","state":"standard","repositories":49},{"license":"BSD-3-Clause","state":"standard","repositories":47},{"license":"MPL-2.0","state":"standard","repositories":32},{"license":"ISC","state":"standard","repositories":12},{"license":"BSD-2-Clause","state":"standard","repositories":11}],"ecosystems":[],"top_repositories":[{"id":10019,"full_name":"pyca/cryptography","url":"https://github.com/pyca/cryptography/","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.","ecosystem":"pypi","ecosystems":["pypi","crates"],"primary_language":"Python","languages":["Python","Rust"],"topics":["python","cryptography"],"license_spdx":null,"license_state":"custom","stars":7664,"forks":1787,"watchers":127,"monthly_downloads":1379176440,"latest_score":84,"latest_band":"good","latest_scanned_at":"2026-07-16T12:17:22.152269Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":35183,"full_name":"mozilla/source-map","url":"https://github.com/mozilla/source-map","description":"Consume and generate source maps.","ecosystem":"npm","ecosystems":["npm","crates"],"primary_language":"JavaScript","languages":["JavaScript","Rust"],"topics":[],"license_spdx":null,"license_state":"custom","stars":3727,"forks":371,"watchers":68,"monthly_downloads":1337509600,"latest_score":68,"latest_band":"moderate","latest_scanned_at":"2026-07-22T16:04:34.879460Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"badge_url":""},{"id":36049,"full_name":"rollup/rollup","url":"https://github.com/rollup/rollup","description":"Next-generation ES module bundler","ecosystem":"npm","ecosystems":["npm","crates"],"primary_language":"JavaScript","languages":["JavaScript","TypeScript"],"topics":["modules","bundler","bundling","es6","optimizer","browser"],"license_spdx":null,"license_state":"custom","stars":26305,"forks":1763,"watchers":249,"monthly_downloads":536059065,"latest_score":87,"latest_band":"excellent","latest_scanned_at":"2026-07-22T21:37:07.306535Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"badge_url":""},{"id":22452,"full_name":"rust-lang/futures-rs","url":"https://github.com/rust-lang/futures-rs","description":"Zero-cost asynchronous programming in Rust","ecosystem":"crates","ecosystems":["crates"],"primary_language":"Rust","languages":["Rust"],"topics":["async-foundations"],"license_spdx":"Apache-2.0","license_state":"standard","stars":5881,"forks":696,"watchers":93,"monthly_downloads":394770827,"latest_score":75,"latest_band":"good","latest_scanned_at":"2026-07-18T17:06:49.025497Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":29548,"full_name":"parcel-bundler/lightningcss","url":"https://github.com/parcel-bundler/lightningcss","description":"An extremely fast CSS parser, transformer, bundler, and minifier written in Rust.","ecosystem":"npm","ecosystems":["npm","crates"],"primary_language":"Rust","languages":["Rust"],"topics":["css","parser","compiler","minifier","rust","build-tool","parcel","selectors"],"license_spdx":"MPL-2.0","license_state":"standard","stars":7621,"forks":286,"watchers":23,"monthly_downloads":362144024,"latest_score":70,"latest_band":"good","latest_scanned_at":"2026-07-20T20:58:10.227377Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":10754,"full_name":"samuelcolvin/watchfiles","url":"https://github.com/samuelcolvin/watchfiles","description":"Simple, modern and fast file watching and code reload for Python, written in Rust","ecosystem":"pypi","ecosystems":["pypi","crates"],"primary_language":"Python","languages":["Python","Rust"],"topics":["python","asyncio","filesystem","notify","inotify","inotifywatch","uvicorn","rust"],"license_spdx":"MIT","license_state":"standard","stars":2518,"forks":141,"watchers":15,"monthly_downloads":325903969,"latest_score":68,"latest_band":"moderate","latest_scanned_at":"2026-07-16T22:21:45.949435Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":1330,"median":56,"p25":48,"p75":62},{"label":"100 – 999","repositories":684,"median":65,"p25":58,"p75":71},{"label":"1,000 – 9,999","repositories":374,"median":73,"p25":67,"p75":77},{"label":"10,000 and more","repositories":161,"median":79,"p25":73,"p75":83}],"popularity_downloads":[{"label":"Under 10K / month","repositories":883,"median":60,"p25":52,"p75":68},{"label":"10K – 1M","repositories":724,"median":63,"p25":55,"p75":71},{"label":"1M – 100M","repositories":296,"median":65,"p25":56,"p75":73},{"label":"100M and more","repositories":21,"median":73,"p25":66,"p75":76}],"freshness":[{"label":"Pushed within 30 days","repositories":2355},{"label":"31 – 90 days","repositories":47},{"label":"91 – 365 days","repositories":77},{"label":"Over a year","repositories":70}],"median_days_since_push":0,"dependencies":{"basis":1410,"median_direct":12,"median_indirect":203,"median_total":222,"buckets":[{"label":"0","repositories":31},{"label":"1 – 5","repositories":104},{"label":"6 – 20","repositories":205},{"label":"21 – 50","repositories":128},{"label":"51 – 200","repositories":207},{"label":"201 – 500","repositories":271},{"label":"501 – 1,000","repositories":194},{"label":"Over 1,000","repositories":270}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":2514,"inconclusive_share":0.0008},{"name":"Signed-Releases","mean":0.8,"measured":963,"inconclusive_share":0.6172},{"name":"SAST","mean":1.3,"measured":2511,"inconclusive_share":0.002},{"name":"Fuzzing","mean":1.4,"measured":2516,"inconclusive_share":0.0},{"name":"Branch-Protection","mean":1.7,"measured":1817,"inconclusive_share":0.2778},{"name":"Token-Permissions","mean":1.7,"measured":2375,"inconclusive_share":0.056},{"name":"Pinned-Dependencies","mean":1.9,"measured":2389,"inconclusive_share":0.0505},{"name":"Code-Review","mean":2.8,"measured":2512,"inconclusive_share":0.0016},{"name":"Security-Policy","mean":2.8,"measured":2516,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":4.7,"measured":2516,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":5.7,"measured":2514,"inconclusive_share":0.0008},{"name":"Contributors","mean":7.0,"measured":2516,"inconclusive_share":0.0},{"name":"Maintained","mean":7.3,"measured":2516,"inconclusive_share":0.0},{"name":"CI-Tests","mean":7.8,"measured":2139,"inconclusive_share":0.1498},{"name":"License","mean":9.3,"measured":2516,"inconclusive_share":0.0},{"name":"Binary-Artifacts","mean":9.5,"measured":2515,"inconclusive_share":0.0004},{"name":"Dangerous-Workflow","mean":9.7,"measured":2375,"inconclusive_share":0.056},{"name":"Packaging","mean":10.0,"measured":1003,"inconclusive_share":0.6014}],"red_flags":[{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":58,"repositories":2346,"share":0.0247,"share_of_record":0.0228},{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":33,"repositories":2549,"share":0.0129,"share_of_record":0.0129},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":1,"repositories":370,"share":0.0027,"share_of_record":0.0004},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":0,"repositories":122,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[8,44,80,141,118,131,274,498,620,635]},{"key":"community","name":"Community & Adoption","bins":[9,60,186,368,405,484,412,334,205,86]},{"key":"governance","name":"Sustainability & Governance","bins":[0,15,40,132,224,621,874,435,199,9]},{"key":"engineering","name":"Engineering Quality","bins":[7,17,47,136,239,381,626,603,354,139]},{"key":"security","name":"Security","bins":[15,18,167,473,696,602,347,187,39,5]},{"key":"ai_readiness","name":"AI Readiness","bins":[0,6,155,424,657,449,321,327,188,22]}],"downloads_top1pct_share":0.5869}