{"ecosystem":"go","ecosystem_label":"Go","indexed_repositories":28412,"inspected_repositories":28411,"monthly_downloads":1315724541,"median_score":53,"share_good_or_better":0.3085,"computed_at":"2026-10-24T17:36:34.947845Z","bands":[{"band":"exceptional","repositories":989,"monthly_downloads":332226123},{"band":"excellent","repositories":3302,"monthly_downloads":93601527},{"band":"good","repositories":4474,"monthly_downloads":637953844},{"band":"moderate","repositories":6823,"monthly_downloads":90074639},{"band":"weak","repositories":6080,"monthly_downloads":9360505},{"band":"at_risk","repositories":5096,"monthly_downloads":120449687},{"band":"critical","repositories":1647,"monthly_downloads":32058216}],"histogram":[{"start":0,"count":31},{"start":5,"count":191},{"start":10,"count":420},{"start":15,"count":1005},{"start":20,"count":1098},{"start":25,"count":1878},{"start":30,"count":2120},{"start":35,"count":2224},{"start":40,"count":1879},{"start":45,"count":1977},{"start":50,"count":2665},{"start":55,"count":2105},{"start":60,"count":2053},{"start":65,"count":1902},{"start":70,"count":1161},{"start":75,"count":1411},{"start":80,"count":1582},{"start":85,"count":1152},{"start":90,"count":1022},{"start":95,"count":535}],"categories":[{"key":"vitality","name":"Vitality","median":67,"record_median":68,"repositories":28412},{"key":"community","name":"Community & Adoption","median":27,"record_median":44,"repositories":28412},{"key":"governance","name":"Sustainability & Governance","median":52,"record_median":58,"repositories":28412},{"key":"engineering","name":"Engineering Quality","median":62,"record_median":66,"repositories":28412},{"key":"security","name":"Security","median":44,"record_median":49,"repositories":28412},{"key":"ai_readiness","name":"AI Readiness","median":65,"record_median":57,"repositories":28412}],"practices":[{"key":"readme","label":"README","share":0.8824,"repositories":28411},{"key":"license","label":"License detected","share":0.8743,"repositories":28411},{"key":"ci","label":"CI workflows","share":0.774,"repositories":28411},{"key":"tests","label":"Automated tests","share":0.9079,"repositories":28411},{"key":"linter","label":"Linter configuration","share":0.3998,"repositories":28411},{"key":"docs_dir","label":"Documentation directory","share":0.4057,"repositories":28411},{"key":"contributing","label":"Contributing guide","share":0.2765,"repositories":28411},{"key":"security_policy","label":"Security policy","share":0.1801,"repositories":28411},{"key":"code_of_conduct","label":"Code of conduct","share":0.1615,"repositories":28411},{"key":"agent_instructions","label":"AI agent instructions","share":0.2817,"repositories":28411},{"key":"bootstrap","label":"One-command bootstrap","share":0.5387,"repositories":28411},{"key":"llms_txt","label":"llms.txt","share":0.1259,"repositories":28411}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":13694,"median_score":62},{"key":"user","label":"Personal accounts","repositories":14717,"median_score":45}],"bus_factor":[{"bucket":"1","repositories":23408},{"bucket":"2","repositories":2623},{"bucket":"3–5","repositories":1543},{"bucket":"6+","repositories":334}],"single_maintainer_share":0.8388,"single_maintainer_high_reliance":22,"licenses":[{"license":"MIT","state":"standard","repositories":12100},{"license":"Apache-2.0","state":"standard","repositories":7577},{"license":null,"state":"absent","repositories":3570},{"license":null,"state":"custom","repositories":1675},{"license":"GPL-3.0","state":"standard","repositories":750},{"license":"BSD-3-Clause","state":"standard","repositories":733},{"license":"AGPL-3.0","state":"standard","repositories":674},{"license":"MPL-2.0","state":"standard","repositories":652},{"license":"BSD-2-Clause","state":"standard","repositories":213},{"license":"LGPL-3.0","state":"standard","repositories":87}],"ecosystems":[],"top_repositories":[{"id":35199,"full_name":"WebReflection/flatted","url":"https://github.com/WebReflection/flatted","description":"A fast and minimal circular JSON parser.","ecosystem":"npm","ecosystems":["npm","go"],"primary_language":"JavaScript","languages":["JavaScript","Go","PHP"],"topics":["circular","json","fast","parser","minimal"],"license_spdx":"ISC","license_state":"standard","stars":1156,"forks":99,"watchers":10,"monthly_downloads":582996071,"latest_score":71,"latest_band":"good","latest_scanned_at":"2026-09-16T09:07:09.496706Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/WebReflection/flatted?v=401707dd-1","icon_source_type":"avatar","badge_url":""},{"id":3075,"full_name":"modal-labs/modal-client","url":"https://github.com/modal-labs/modal-client","description":"SDK libraries for Modal","ecosystem":"pypi","ecosystems":["pypi","npm","go"],"primary_language":"Python","languages":["Python","Go","TypeScript"],"topics":["cloud","data-science","distributed","machine-learning","modal","python","serverless","ai","genai","client","infrastructure"],"license_spdx":"Apache-2.0","license_state":"standard","stars":528,"forks":139,"watchers":9,"monthly_downloads":51149182,"latest_score":94,"latest_band":"exceptional","latest_scanned_at":"2026-10-23T22:33:37.723503Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/modal-labs/modal-client?v=51b29840-1","icon_source_type":"homepage","badge_url":""},{"id":7045,"full_name":"supabase/cli","url":"https://github.com/supabase/cli","description":"Supabase CLI. Manage postgres migrations, run Supabase locally, deploy edge functions. Postgres backups. Generating types from your database schema.","ecosystem":"npm","ecosystems":["npm","go"],"primary_language":"TypeScript","languages":["TypeScript"],"topics":["cli","database","database-management","dbms","environment","local","postgres","postgresql","supabase","config","effect","schema"],"license_spdx":null,"license_state":"absent","stars":2443,"forks":536,"watchers":30,"monthly_downloads":40590679,"latest_score":98,"latest_band":"exceptional","latest_scanned_at":"2026-10-22T16:48:45.742190Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/supabase/cli?v=f4d5f686-1","icon_source_type":"avatar","badge_url":""},{"id":4837,"full_name":"google/flatbuffers","url":"https://github.com/google/flatbuffers","description":"FlatBuffers: Memory Efficient Serialization Library","ecosystem":"npm","ecosystems":["npm","packagist","maven","pypi","go"],"primary_language":"C++","languages":["C++","Rust"],"topics":["flatbuffers","serialization","serialization-library","json-parser","marshalling","rpc","zero-copy","mmap","cross-platform","c-plus-plus","java","c-sharp","go","python","rust","javascript","typescript","grpc","protobuf","google"],"license_spdx":"Apache-2.0","license_state":"standard","stars":26468,"forks":3660,"watchers":627,"monthly_downloads":32818574,"latest_score":34,"latest_band":"at_risk","latest_scanned_at":"2026-09-16T11:57:58.102444Z","has_high_risk_jurisdiction_exposure":true,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":["high_risk_jurisdiction_exposure"],"icon_url":"/icon/v1/google/flatbuffers?v=023854c4-1","icon_source_type":"homepage","badge_url":""},{"id":30751,"full_name":"tree-sitter/tree-sitter-bash","url":"https://github.com/tree-sitter/tree-sitter-bash","description":"Bash grammar for tree-sitter","ecosystem":"npm","ecosystems":["npm","pypi","crates","go"],"primary_language":"C","languages":["C","JavaScript"],"topics":["tree-sitter","bash","parser","incremental","parsing","text-editors"],"license_spdx":"MIT","license_state":"standard","stars":333,"forks":135,"watchers":9,"monthly_downloads":32150299,"latest_score":63,"latest_band":"moderate","latest_scanned_at":"2026-10-24T01:29:50.387937Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"dormant","red_flags":[],"icon_url":"/icon/v1/tree-sitter/tree-sitter-bash?v=a07c055f-1","icon_source_type":"avatar","badge_url":""},{"id":8022,"full_name":"svix/svix-webhooks","url":"https://github.com/svix/svix-webhooks","description":"The open source and enterprise-ready webhooks service 🦀","ecosystem":"npm","ecosystems":["npm","pypi","packagist","crates","go","maven","rubygems"],"primary_language":"Rust","languages":["Rust","C#"],"topics":["webhooks","rust","webhook-server","webhook-service","webhook","webhooks-server","webhook-dispatcher","webhook-ingester","api","background-jobs","background-tasks","kafka","message-queue","pubsub","queue","rabbitmq","redis","stream","event-driven","diahook","svix","development-tools","asynchronous","network-programming","web-programming","typescript"],"license_spdx":"MIT","license_state":"standard","stars":3397,"forks":281,"watchers":29,"monthly_downloads":31859194,"latest_score":98,"latest_band":"exceptional","latest_scanned_at":"2026-09-11T05:52:19.962762Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/svix/svix-webhooks?v=75d1c5f6-1","icon_source_type":"homepage","badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":24579,"median":48,"p25":34,"p75":63},{"label":"100 – 999","repositories":2398,"median":78,"p25":62,"p75":89},{"label":"1,000 – 9,999","repositories":1140,"median":86,"p25":69,"p75":94},{"label":"10,000 and more","repositories":294,"median":94,"p25":87,"p75":97}],"popularity_downloads":[{"label":"Under 10K / month","repositories":782,"median":63,"p25":53,"p75":75},{"label":"10K – 1M","repositories":200,"median":81,"p25":69,"p75":90},{"label":"1M – 100M","repositories":71,"median":86,"p25":51,"p75":94},{"label":"100M and more","repositories":1,"median":71,"p25":71,"p75":71}],"freshness":[{"label":"Pushed within 30 days","repositories":16258},{"label":"31 – 90 days","repositories":8404},{"label":"91 – 365 days","repositories":1922},{"label":"Over a year","repositories":1827}],"median_days_since_push":18,"dependencies":{"basis":15006,"median_direct":7,"median_indirect":29,"median_total":38,"buckets":[{"label":"0","repositories":1294},{"label":"1 – 5","repositories":2003},{"label":"6 – 20","repositories":2583},{"label":"21 – 50","repositories":2348},{"label":"51 – 200","repositories":3890},{"label":"201 – 500","repositories":1585},{"label":"501 – 1,000","repositories":698},{"label":"Over 1,000","repositories":605}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":28160,"inconclusive_share":0.0023},{"name":"Branch-Protection","mean":1.0,"measured":23574,"inconclusive_share":0.1648},{"name":"Fuzzing","mean":1.1,"measured":28205,"inconclusive_share":0.0007},{"name":"Signed-Releases","mean":1.1,"measured":11409,"inconclusive_share":0.5958},{"name":"Code-Review","mean":1.5,"measured":28076,"inconclusive_share":0.0053},{"name":"SAST","mean":1.7,"measured":28180,"inconclusive_share":0.0016},{"name":"Pinned-Dependencies","mean":2.2,"measured":22516,"inconclusive_share":0.2023},{"name":"Token-Permissions","mean":2.2,"measured":21729,"inconclusive_share":0.2302},{"name":"Security-Policy","mean":2.3,"measured":28225,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":3.9,"measured":28225,"inconclusive_share":0.0},{"name":"Contributors","mean":4.4,"measured":28225,"inconclusive_share":0.0},{"name":"Maintained","mean":5.1,"measured":28225,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":5.3,"measured":28213,"inconclusive_share":0.0004},{"name":"CI-Tests","mean":7.1,"measured":17584,"inconclusive_share":0.377},{"name":"License","mean":8.7,"measured":28225,"inconclusive_share":0.0},{"name":"Binary-Artifacts","mean":9.8,"measured":28225,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.8,"measured":21729,"inconclusive_share":0.2302},{"name":"Packaging","mean":10.0,"measured":7920,"inconclusive_share":0.7194}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":1901,"repositories":28412,"share":0.0669,"share_of_record":0.0669},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":579,"repositories":22670,"share":0.0255,"share_of_record":0.0204},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":7,"repositories":13918,"share":0.0005,"share_of_record":0.0002},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":0,"repositories":149,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[69,940,1360,1004,2631,4491,4970,5045,4806,3096]},{"key":"community","name":"Community & Adoption","bins":[778,4924,9440,4462,3661,2030,1376,887,570,284]},{"key":"governance","name":"Sustainability & Governance","bins":[3,265,1161,5821,4874,8095,4128,2557,1271,237]},{"key":"engineering","name":"Engineering Quality","bins":[348,486,1262,3159,2814,4269,5766,5527,3726,1055]},{"key":"security","name":"Security","bins":[213,1082,4630,5994,5286,4749,3658,2064,641,95]},{"key":"ai_readiness","name":"AI Readiness","bins":[3,23,101,1018,3009,6207,7237,5325,4037,1452]}],"downloads_top1pct_share":0.9992}