{"ecosystem":"go","ecosystem_label":"Go","indexed_repositories":18223,"inspected_repositories":18223,"monthly_downloads":1348387589,"median_score":56,"share_good_or_better":0.3397,"computed_at":"2026-09-09T08:04:53.187586Z","bands":[{"band":"exceptional","repositories":766,"monthly_downloads":339522577},{"band":"excellent","repositories":2369,"monthly_downloads":72421350},{"band":"good","repositories":3056,"monthly_downloads":680035578},{"band":"moderate","repositories":4855,"monthly_downloads":197893867},{"band":"weak","repositories":3936,"monthly_downloads":6259253},{"band":"at_risk","repositories":2685,"monthly_downloads":51946528},{"band":"critical","repositories":556,"monthly_downloads":308436}],"histogram":[{"start":0,"count":13},{"start":5,"count":105},{"start":10,"count":124},{"start":15,"count":314},{"start":20,"count":499},{"start":25,"count":959},{"start":30,"count":1227},{"start":35,"count":1382},{"start":40,"count":1212},{"start":45,"count":1342},{"start":50,"count":1854},{"start":55,"count":1497},{"start":60,"count":1504},{"start":65,"count":1343},{"start":70,"count":759},{"start":75,"count":954},{"start":80,"count":1066},{"start":85,"count":856},{"start":90,"count":759},{"start":95,"count":454}],"categories":[{"key":"vitality","name":"Vitality","median":72,"record_median":70,"repositories":18223},{"key":"community","name":"Community & Adoption","median":29,"record_median":46,"repositories":18223},{"key":"governance","name":"Sustainability & Governance","median":53,"record_median":59,"repositories":18223},{"key":"engineering","name":"Engineering Quality","median":63,"record_median":65,"repositories":18223},{"key":"security","name":"Security","median":44,"record_median":47,"repositories":18223},{"key":"ai_readiness","name":"AI Readiness","median":63,"record_median":53,"repositories":18223}],"practices":[{"key":"readme","label":"README","share":0.9011,"repositories":18223},{"key":"license","label":"License detected","share":0.8764,"repositories":18223},{"key":"ci","label":"CI workflows","share":0.7811,"repositories":18223},{"key":"tests","label":"Automated tests","share":0.9103,"repositories":18223},{"key":"linter","label":"Linter configuration","share":0.4115,"repositories":18223},{"key":"docs_dir","label":"Documentation directory","share":0.4115,"repositories":18223},{"key":"contributing","label":"Contributing guide","share":0.2886,"repositories":18223},{"key":"security_policy","label":"Security policy","share":0.178,"repositories":18223},{"key":"code_of_conduct","label":"Code of conduct","share":0.1736,"repositories":18223},{"key":"agent_instructions","label":"AI agent instructions","share":0.2866,"repositories":18223},{"key":"bootstrap","label":"One-command bootstrap","share":0.5492,"repositories":18223},{"key":"llms_txt","label":"llms.txt","share":0.0483,"repositories":18223}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":9396,"median_score":63},{"key":"user","label":"Personal accounts","repositories":8827,"median_score":48}],"bus_factor":[{"bucket":"1","repositories":14626},{"bucket":"2","repositories":1890},{"bucket":"3–5","repositories":1154},{"bucket":"6+","repositories":236}],"single_maintainer_share":0.8168,"single_maintainer_high_reliance":17,"licenses":[{"license":"MIT","state":"standard","repositories":7620},{"license":"Apache-2.0","state":"standard","repositories":5102},{"license":null,"state":"absent","repositories":2253},{"license":null,"state":"custom","repositories":1070},{"license":"GPL-3.0","state":"standard","repositories":497},{"license":"AGPL-3.0","state":"standard","repositories":459},{"license":"BSD-3-Clause","state":"standard","repositories":437},{"license":"MPL-2.0","state":"standard","repositories":387},{"license":"BSD-2-Clause","state":"standard","repositories":143},{"license":"LGPL-3.0","state":"standard","repositories":64}],"ecosystems":[],"top_repositories":[{"id":35199,"full_name":"WebReflection/flatted","url":"https://github.com/WebReflection/flatted","description":"A fast and minimal circular JSON parser.","ecosystem":"npm","ecosystems":["npm","go"],"primary_language":"JavaScript","languages":["JavaScript","Go","PHP"],"topics":["circular","json","fast","parser","minimal"],"license_spdx":"ISC","license_state":"standard","stars":1151,"forks":97,"watchers":10,"monthly_downloads":576704581,"latest_score":77,"latest_band":"good","latest_scanned_at":"2026-08-04T18:17:45.802214Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"","icon_source_type":null,"badge_url":""},{"id":3075,"full_name":"modal-labs/modal-client","url":"https://github.com/modal-labs/modal-client","description":"SDK libraries for Modal","ecosystem":"pypi","ecosystems":["pypi","npm","go"],"primary_language":"Python","languages":["Python","Go","TypeScript"],"topics":["cloud","data-science","distributed","machine-learning","modal","python","serverless","ai","genai","client","infrastructure"],"license_spdx":"Apache-2.0","license_state":"standard","stars":511,"forks":124,"watchers":9,"monthly_downloads":82585265,"latest_score":94,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T12:07:23.035815Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/modal-labs/modal-client?v=51b29840-1","icon_source_type":"homepage","badge_url":""},{"id":30751,"full_name":"tree-sitter/tree-sitter-bash","url":"https://github.com/tree-sitter/tree-sitter-bash","description":"Bash grammar for tree-sitter","ecosystem":"pypi","ecosystems":["pypi","npm","crates","go"],"primary_language":"C","languages":["C","JavaScript"],"topics":["tree-sitter","bash","parser","incremental","parsing","text-editors"],"license_spdx":"MIT","license_state":"standard","stars":327,"forks":120,"watchers":10,"monthly_downloads":41438157,"latest_score":62,"latest_band":"moderate","latest_scanned_at":"2026-08-27T15:11:40.787079Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"dormant","red_flags":[],"icon_url":"/icon/v1/tree-sitter/tree-sitter-bash?v=a07c055f-1","icon_source_type":"avatar","badge_url":""},{"id":1378,"full_name":"cucumber/messages","url":"https://github.com/cucumber/messages","description":"A message protocol for representing results and other information from Cucumber","ecosystem":"npm","ecosystems":["npm","packagist","hex","pypi","rubygems","go","maven"],"primary_language":"C#","languages":["C#","PHP","Java","C++","Dart"],"topics":["polyglot-release","dotnet","elixir","go","java","javascript","perl","php","ruby","tidelift","gherkin","cucumber","bdd"],"license_spdx":"MIT","license_state":"standard","stars":41,"forks":24,"watchers":68,"monthly_downloads":34826805,"latest_score":95,"latest_band":"exceptional","latest_scanned_at":"2026-08-22T17:08:30.778181Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/cucumber/messages?v=07b417f0-1","icon_source_type":"avatar","badge_url":""},{"id":8022,"full_name":"svix/svix-webhooks","url":"https://github.com/svix/svix-webhooks","description":"The open source and enterprise-ready webhooks service 🦀","ecosystem":"npm","ecosystems":["npm","pypi","packagist","crates","go","maven","rubygems"],"primary_language":"Rust","languages":["Rust","C#"],"topics":["webhooks","rust","webhook-server","webhook-service","webhook","webhooks-server","webhook-dispatcher","webhook-ingester","api","background-jobs","background-tasks","kafka","message-queue","pubsub","queue","rabbitmq","redis","stream","event-driven","svix","diahook","development-tools","network-programming","web-programming","asynchronous","typescript"],"license_spdx":"MIT","license_state":"standard","stars":3392,"forks":279,"watchers":29,"monthly_downloads":32734474,"latest_score":98,"latest_band":"exceptional","latest_scanned_at":"2026-09-08T18:25:14.800575Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/svix/svix-webhooks?v=75d1c5f6-1","icon_source_type":"homepage","badge_url":""},{"id":26029,"full_name":"cucumber/gherkin","url":"https://github.com/cucumber/gherkin","description":"A parser and compiler for the Gherkin language.","ecosystem":"npm","ecosystems":["npm","pypi","packagist","hex","rubygems","go","maven"],"primary_language":"C","languages":["C"],"topics":["gherkin","polyglot-release","dart","dotnet","elixir","go","java","javascript","lexer","objective-c","parser","perl","php","python","ruby","tidelift","cucumber","bdd"],"license_spdx":"MIT","license_state":"standard","stars":400,"forks":101,"watchers":91,"monthly_downloads":32511421,"latest_score":96,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T13:11:25.987179Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/cucumber/gherkin?v=cf8da60d-1","icon_source_type":"readme","badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":15482,"median":51,"p25":38,"p75":65},{"label":"100 – 999","repositories":1663,"median":78,"p25":63,"p75":89},{"label":"1,000 – 9,999","repositories":833,"median":87,"p25":73,"p75":94},{"label":"10,000 and more","repositories":245,"median":94,"p25":88,"p75":98}],"popularity_downloads":[{"label":"Under 10K / month","repositories":589,"median":60,"p25":51,"p75":74},{"label":"10K – 1M","repositories":126,"median":85,"p25":73,"p75":92},{"label":"1M – 100M","repositories":56,"median":84,"p25":60,"p75":95},{"label":"100M and more","repositories":1,"median":77,"p25":77,"p75":77}],"freshness":[{"label":"Pushed within 30 days","repositories":15580},{"label":"31 – 90 days","repositories":1368},{"label":"91 – 365 days","repositories":538},{"label":"Over a year","repositories":737}],"median_days_since_push":3,"dependencies":{"basis":10026,"median_direct":8,"median_indirect":31,"median_total":43,"buckets":[{"label":"0","repositories":736},{"label":"1 – 5","repositories":1285},{"label":"6 – 20","repositories":1744},{"label":"21 – 50","repositories":1554},{"label":"51 – 200","repositories":2617},{"label":"201 – 500","repositories":1123},{"label":"501 – 1,000","repositories":497},{"label":"Over 1,000","repositories":470}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":18126,"inconclusive_share":0.0008},{"name":"Fuzzing","mean":1.0,"measured":18138,"inconclusive_share":0.0001},{"name":"Branch-Protection","mean":1.1,"measured":14875,"inconclusive_share":0.18},{"name":"Signed-Releases","mean":1.1,"measured":7470,"inconclusive_share":0.5882},{"name":"Code-Review","mean":1.7,"measured":18053,"inconclusive_share":0.0048},{"name":"SAST","mean":1.8,"measured":18127,"inconclusive_share":0.0007},{"name":"Token-Permissions","mean":2.0,"measured":14096,"inconclusive_share":0.2229},{"name":"Pinned-Dependencies","mean":2.2,"measured":14559,"inconclusive_share":0.1974},{"name":"Security-Policy","mean":2.3,"measured":18140,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":4.1,"measured":18140,"inconclusive_share":0.0},{"name":"Contributors","mean":4.5,"measured":18140,"inconclusive_share":0.0},{"name":"Maintained","mean":5.2,"measured":18140,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":5.8,"measured":18131,"inconclusive_share":0.0005},{"name":"CI-Tests","mean":7.3,"measured":11560,"inconclusive_share":0.3627},{"name":"License","mean":8.7,"measured":18140,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.7,"measured":14096,"inconclusive_share":0.2229},{"name":"Binary-Artifacts","mean":9.8,"measured":18140,"inconclusive_share":0.0},{"name":"Packaging","mean":10.0,"measured":5315,"inconclusive_share":0.707}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":645,"repositories":18223,"share":0.0354,"share_of_record":0.0354},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":292,"repositories":14550,"share":0.0201,"share_of_record":0.016},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":3,"repositories":6817,"share":0.0004,"share_of_record":0.0002},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":0,"repositories":131,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[26,382,588,307,649,1962,4136,4252,3512,2409]},{"key":"community","name":"Community & Adoption","bins":[446,2837,5993,2883,2442,1369,949,656,426,222]},{"key":"governance","name":"Sustainability & Governance","bins":[2,134,599,3450,2937,4980,2839,1888,1165,229]},{"key":"engineering","name":"Engineering Quality","bins":[207,290,717,1919,1718,2710,3773,3663,2523,703]},{"key":"security","name":"Security","bins":[123,668,2831,3924,3421,3196,2345,1278,379,58]},{"key":"ai_readiness","name":"AI Readiness","bins":[7,36,178,776,2635,4205,4122,2932,2561,771]}],"downloads_top1pct_share":0.9992}