{"ecosystem":"hex","ecosystem_label":"Hex","indexed_repositories":1097,"inspected_repositories":1097,"monthly_downloads":253374794,"median_score":51,"share_good_or_better":0.0656,"computed_at":"2026-07-23T11:35:27.817122Z","bands":[{"band":"excellent","repositories":1,"monthly_downloads":26974786},{"band":"good","repositories":71,"monthly_downloads":83495996},{"band":"moderate","repositories":529,"monthly_downloads":111644581},{"band":"at_risk","repositories":451,"monthly_downloads":26573544},{"band":"critical","repositories":45,"monthly_downloads":4685887}],"histogram":[{"start":0,"count":0},{"start":5,"count":0},{"start":10,"count":3},{"start":15,"count":3},{"start":20,"count":13},{"start":25,"count":26},{"start":30,"count":39},{"start":35,"count":78},{"start":40,"count":154},{"start":45,"count":180},{"start":50,"count":167},{"start":55,"count":176},{"start":60,"count":126},{"start":65,"count":60},{"start":70,"count":48},{"start":75,"count":20},{"start":80,"count":3},{"start":85,"count":1},{"start":90,"count":0},{"start":95,"count":0}],"categories":[{"key":"vitality","name":"Vitality","median":48,"record_median":73,"repositories":1097},{"key":"community","name":"Community & Adoption","median":51,"record_median":46,"repositories":1097},{"key":"governance","name":"Sustainability & Governance","median":62,"record_median":59,"repositories":1097},{"key":"engineering","name":"Engineering Quality","median":55,"record_median":66,"repositories":1097},{"key":"security","name":"Security","median":38,"record_median":45,"repositories":1097},{"key":"ai_readiness","name":"AI Readiness","median":29,"record_median":46,"repositories":1097}],"practices":[{"key":"readme","label":"README","share":0.9781,"repositories":1097},{"key":"license","label":"License detected","share":0.918,"repositories":1097},{"key":"ci","label":"CI workflows","share":0.8295,"repositories":1097},{"key":"tests","label":"Automated tests","share":0.9745,"repositories":1097},{"key":"linter","label":"Linter configuration","share":0.0191,"repositories":1097},{"key":"docs_dir","label":"Documentation directory","share":0.1112,"repositories":1097},{"key":"contributing","label":"Contributing guide","share":0.1996,"repositories":1097},{"key":"security_policy","label":"Security policy","share":0.0383,"repositories":1097},{"key":"code_of_conduct","label":"Code of conduct","share":0.1677,"repositories":1097},{"key":"agent_instructions","label":"AI agent instructions","share":0.0966,"repositories":1097},{"key":"bootstrap","label":"One-command bootstrap","share":0.1304,"repositories":1097},{"key":"llms_txt","label":"llms.txt","share":0.0027,"repositories":1097}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":625,"median_score":55},{"key":"user","label":"Personal accounts","repositories":472,"median_score":46}],"bus_factor":[{"bucket":"1","repositories":858},{"bucket":"2","repositories":173},{"bucket":"3–5","repositories":62},{"bucket":"6+","repositories":3}],"single_maintainer_share":0.7828,"single_maintainer_high_reliance":13,"licenses":[{"license":"MIT","state":"standard","repositories":537},{"license":"Apache-2.0","state":"standard","repositories":273},{"license":null,"state":"custom","repositories":163},{"license":null,"state":"absent","repositories":90},{"license":"BSD-2-Clause","state":"standard","repositories":10},{"license":"BSD-3-Clause","state":"standard","repositories":9},{"license":"GPL-3.0","state":"standard","repositories":3},{"license":"ISC","state":"standard","repositories":3},{"license":"MPL-2.0","state":"standard","repositories":2},{"license":"Unlicense","state":"standard","repositories":2}],"ecosystems":[],"top_repositories":[{"id":24862,"full_name":"supabase/phoenix","url":"https://github.com/supabase/phoenix","description":"Peace of mind from prototype to production","ecosystem":"npm","ecosystems":["npm","hex"],"primary_language":"Elixir","languages":["Elixir","JavaScript"],"topics":[],"license_spdx":"MIT","license_state":"standard","stars":3,"forks":6,"watchers":0,"monthly_downloads":50238731,"latest_score":68,"latest_band":"moderate","latest_scanned_at":"2026-07-19T08:35:08.522560Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":1378,"full_name":"cucumber/messages","url":"https://github.com/cucumber/messages","description":"A message protocol for representing results and other information from Cucumber","ecosystem":"go","ecosystems":["go","hex","maven","npm","packagist","pypi","rubygems"],"primary_language":"C#","languages":[],"topics":["dotnet","elixir","go","java","javascript","perl","php","polyglot-release","ruby","tidelift"],"license_spdx":"MIT","license_state":"standard","stars":40,"forks":24,"watchers":68,"monthly_downloads":30116305,"latest_score":79,"latest_band":"good","latest_scanned_at":"2026-07-13T21:42:33.390568Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":26029,"full_name":"cucumber/gherkin","url":"https://github.com/cucumber/gherkin","description":"A parser and compiler for the Gherkin language.","ecosystem":"npm","ecosystems":["npm","pypi","packagist","hex","rubygems","go","maven"],"primary_language":"C","languages":["C"],"topics":["gherkin","polyglot-release","dart","dotnet","elixir","go","java","javascript","lexer","objective-c","parser","perl","php","python","ruby","tidelift","cucumber","bdd"],"license_spdx":"MIT","license_state":"standard","stars":372,"forks":98,"watchers":91,"monthly_downloads":27777826,"latest_score":82,"latest_band":"good","latest_scanned_at":"2026-07-19T16:58:40.636359Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":8646,"full_name":"taskforcesh/bullmq","url":"https://github.com/taskforcesh/bullmq","description":"BullMQ - Message Queue and Batch processing for NodeJS, Python, Elixir and PHP based on Redis","ecosystem":"npm","ecosystems":["npm","hex","crates","pypi","packagist"],"primary_language":"TypeScript","languages":["TypeScript","Rust","Elixir"],"topics":["background-jobs","nodejs","queue","redis","typescript","python","elixir","php","bull","bullmq","queues","jobs","worker","job","background","asynchronous","database"],"license_spdx":"MIT","license_state":"standard","stars":9127,"forks":654,"watchers":36,"monthly_downloads":26974786,"latest_score":87,"latest_band":"excellent","latest_scanned_at":"2026-07-16T00:14:54.282663Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":876,"full_name":"statsig-io/statsig-server-core","url":"https://github.com/statsig-io/statsig-server-core","description":null,"ecosystem":"crates","ecosystems":["crates","go","hex","maven","npm","packagist","pypi"],"primary_language":"Rust","languages":[],"topics":[],"license_spdx":"ISC","license_state":"standard","stars":24,"forks":20,"watchers":1,"monthly_downloads":7259103,"latest_score":64,"latest_band":"moderate","latest_scanned_at":"2026-07-13T18:39:06.966522Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":30667,"full_name":"ethereum/c-kzg-4844","url":"https://github.com/ethereum/c-kzg-4844","description":"A minimal implementation of the Polynomial Commitments API for EIP-4844 and EIP-7594, written in C.","ecosystem":"pypi","ecosystems":["pypi","crates","go","hex"],"primary_language":"C","languages":["C","Rust"],"topics":[],"license_spdx":"Apache-2.0","license_state":"standard","stars":171,"forks":158,"watchers":13,"monthly_downloads":7036786,"latest_score":75,"latest_band":"good","latest_scanned_at":"2026-07-21T20:49:22.693605Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"organic","abandonment_state":"maintained","red_flags":[],"badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":674,"median":49,"p25":41,"p75":57},{"label":"100 – 999","repositories":347,"median":54,"p25":46,"p75":61},{"label":"1,000 – 9,999","repositories":75,"median":64,"p25":53,"p75":71},{"label":"10,000 and more","repositories":1,"median":78,"p25":78,"p75":78}],"popularity_downloads":[{"label":"Under 10K / month","repositories":481,"median":49,"p25":41,"p75":57},{"label":"10K – 1M","repositories":506,"median":53,"p25":45,"p75":61},{"label":"1M – 100M","repositories":33,"median":64,"p25":50,"p75":70},{"label":"100M and more","repositories":0,"median":null,"p25":null,"p75":null}],"freshness":[{"label":"Pushed within 30 days","repositories":469},{"label":"31 – 90 days","repositories":209},{"label":"91 – 365 days","repositories":257},{"label":"Over a year","repositories":162}],"median_days_since_push":42,"dependencies":{"basis":864,"median_direct":0,"median_indirect":0,"median_total":0,"buckets":[{"label":"0","repositories":734},{"label":"1 – 5","repositories":10},{"label":"6 – 20","repositories":18},{"label":"21 – 50","repositories":28},{"label":"51 – 200","repositories":39},{"label":"201 – 500","repositories":17},{"label":"501 – 1,000","repositories":14},{"label":"Over 1,000","repositories":4}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.0,"measured":1082,"inconclusive_share":0.0009},{"name":"SAST","mean":0.4,"measured":1083,"inconclusive_share":0.0},{"name":"Signed-Releases","mean":0.5,"measured":72,"inconclusive_share":0.9335},{"name":"Branch-Protection","mean":0.6,"measured":787,"inconclusive_share":0.2733},{"name":"Pinned-Dependencies","mean":0.7,"measured":899,"inconclusive_share":0.1699},{"name":"Fuzzing","mean":0.9,"measured":1083,"inconclusive_share":0.0},{"name":"Security-Policy","mean":1.3,"measured":1083,"inconclusive_share":0.0},{"name":"Token-Permissions","mean":1.7,"measured":897,"inconclusive_share":0.1717},{"name":"Code-Review","mean":2.3,"measured":1081,"inconclusive_share":0.0018},{"name":"Dependency-Update-Tool","mean":2.7,"measured":1083,"inconclusive_share":0.0},{"name":"Maintained","mean":3.7,"measured":1083,"inconclusive_share":0.0},{"name":"CI-Tests","mean":3.9,"measured":983,"inconclusive_share":0.0923},{"name":"Vulnerabilities","mean":6.3,"measured":1083,"inconclusive_share":0.0},{"name":"Contributors","mean":6.6,"measured":1083,"inconclusive_share":0.0},{"name":"License","mean":9.1,"measured":1083,"inconclusive_share":0.0},{"name":"Binary-Artifacts","mean":10.0,"measured":1083,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":10.0,"measured":897,"inconclusive_share":0.1717},{"name":"Packaging","mean":10.0,"measured":22,"inconclusive_share":0.9797}],"red_flags":[{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":24,"repositories":1046,"share":0.0229,"share_of_record":0.0219},{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":13,"repositories":1097,"share":0.0119,"share_of_record":0.0119},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":1,"repositories":39,"share":0.0256,"share_of_record":0.0009},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":0,"repositories":5,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[59,95,157,117,147,124,147,118,91,42]},{"key":"community","name":"Community & Adoption","bins":[0,6,47,187,268,285,199,82,20,3]},{"key":"governance","name":"Sustainability & Governance","bins":[0,0,3,33,66,320,452,185,38,0]},{"key":"engineering","name":"Engineering Quality","bins":[0,3,7,128,195,419,243,91,8,3]},{"key":"security","name":"Security","bins":[8,29,182,378,291,125,67,15,2,0]},{"key":"ai_readiness","name":"AI Readiness","bins":[2,23,534,358,61,77,27,13,2,0]}],"downloads_top1pct_share":0.6315}