{"ecosystem":"maven","ecosystem_label":"Maven","indexed_repositories":878,"inspected_repositories":878,"monthly_downloads":529697666,"median_score":65,"share_good_or_better":0.3656,"computed_at":"2026-07-23T09:11:14.138018Z","bands":[{"band":"excellent","repositories":33,"monthly_downloads":89493849},{"band":"good","repositories":288,"monthly_downloads":303200261},{"band":"moderate","repositories":356,"monthly_downloads":14115063},{"band":"at_risk","repositories":142,"monthly_downloads":120314758},{"band":"critical","repositories":59,"monthly_downloads":2573735}],"histogram":[{"start":0,"count":0},{"start":5,"count":2},{"start":10,"count":6},{"start":15,"count":9},{"start":20,"count":16},{"start":25,"count":26},{"start":30,"count":28},{"start":35,"count":27},{"start":40,"count":42},{"start":45,"count":45},{"start":50,"count":67},{"start":55,"count":80},{"start":60,"count":84},{"start":65,"count":125},{"start":70,"count":112},{"start":75,"count":100},{"start":80,"count":76},{"start":85,"count":30},{"start":90,"count":3},{"start":95,"count":0}],"categories":[{"key":"vitality","name":"Vitality","median":82,"record_median":73,"repositories":878},{"key":"community","name":"Community & Adoption","median":62,"record_median":46,"repositories":878},{"key":"governance","name":"Sustainability & Governance","median":65,"record_median":59,"repositories":878},{"key":"engineering","name":"Engineering Quality","median":68,"record_median":66,"repositories":878},{"key":"security","name":"Security","median":49,"record_median":45,"repositories":878},{"key":"ai_readiness","name":"AI Readiness","median":50,"record_median":46,"repositories":878}],"practices":[{"key":"readme","label":"README","share":0.951,"repositories":878},{"key":"license","label":"License detected","share":0.9271,"repositories":878},{"key":"ci","label":"CI workflows","share":0.8246,"repositories":878},{"key":"tests","label":"Automated tests","share":0.9282,"repositories":878},{"key":"linter","label":"Linter configuration","share":0.3144,"repositories":878},{"key":"docs_dir","label":"Documentation directory","share":0.4522,"repositories":878},{"key":"contributing","label":"Contributing guide","share":0.5034,"repositories":878},{"key":"security_policy","label":"Security policy","share":0.2437,"repositories":878},{"key":"code_of_conduct","label":"Code of conduct","share":0.3337,"repositories":878},{"key":"agent_instructions","label":"AI agent instructions","share":0.3269,"repositories":878},{"key":"bootstrap","label":"One-command bootstrap","share":0.2232,"repositories":878},{"key":"llms_txt","label":"llms.txt","share":0.0216,"repositories":878}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":683,"median_score":68},{"key":"user","label":"Personal accounts","repositories":195,"median_score":52}],"bus_factor":[{"bucket":"1","repositories":478},{"bucket":"2","repositories":201},{"bucket":"3–5","repositories":143},{"bucket":"6+","repositories":51}],"single_maintainer_share":0.5475,"single_maintainer_high_reliance":7,"licenses":[{"license":"Apache-2.0","state":"standard","repositories":353},{"license":"MIT","state":"standard","repositories":211},{"license":null,"state":"custom","repositories":115},{"license":null,"state":"absent","repositories":64},{"license":"GPL-3.0","state":"standard","repositories":39},{"license":"AGPL-3.0","state":"standard","repositories":26},{"license":"BSD-3-Clause","state":"standard","repositories":18},{"license":"MPL-2.0","state":"standard","repositories":15},{"license":"EPL-2.0","state":"standard","repositories":9},{"license":"GPL-2.0","state":"standard","repositories":7}],"ecosystems":[],"top_repositories":[{"id":4837,"full_name":"google/flatbuffers","url":"https://github.com/google/flatbuffers","description":"FlatBuffers: Memory Efficient Serialization Library","ecosystem":"pypi","ecosystems":["pypi","npm","packagist","go","maven"],"primary_language":"C++","languages":["C++","Rust"],"topics":["flatbuffers","serialization","serialization-library","json-parser","marshalling","rpc","zero-copy","mmap","cross-platform","c-plus-plus","java","c-sharp","go","python","rust","javascript","typescript","grpc","protobuf","google"],"license_spdx":"Apache-2.0","license_state":"standard","stars":26240,"forks":3606,"watchers":629,"monthly_downloads":119765899,"latest_score":40,"latest_band":"at_risk","latest_scanned_at":"2026-07-20T17:02:44.024503Z","has_high_risk_jurisdiction_exposure":true,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":["high_risk_jurisdiction_exposure"],"badge_url":""},{"id":21327,"full_name":"dmlc/xgboost","url":"https://github.com/dmlc/xgboost","description":"Scalable, Portable and Distributed Gradient Boosting (GBDT, GBRT or GBM) Library,  for Python, R, Java, Scala, C++ and more. Runs on single machine, Hadoop, Spark, Dask, Flink and DataFlow","ecosystem":"pypi","ecosystems":["pypi","maven"],"primary_language":"C++","languages":["C++","Python","Cuda"],"topics":["gbdt","gbrt","gbm","distributed-systems","xgboost","machine-learning"],"license_spdx":"Apache-2.0","license_state":"standard","stars":28569,"forks":8879,"watchers":884,"monthly_downloads":47481803,"latest_score":86,"latest_band":"excellent","latest_scanned_at":"2026-07-18T13:07:04.753866Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":2339,"full_name":"ionic-team/capacitor","url":"https://github.com/ionic-team/capacitor","description":"Build cross-platform Native Progressive Web Apps for iOS, Android, and the Web ⚡️","ecosystem":"maven","ecosystems":["maven","npm"],"primary_language":"TypeScript","languages":[],"topics":["android","capacitor","cordova","cross-platform","css","html","ionic","ios","java","javascript","pwa","swift"],"license_spdx":"MIT","license_state":"standard","stars":16079,"forks":1216,"watchers":164,"monthly_downloads":43710091,"latest_score":81,"latest_band":"good","latest_scanned_at":"2026-07-14T03:30:44.838082Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":1378,"full_name":"cucumber/messages","url":"https://github.com/cucumber/messages","description":"A message protocol for representing results and other information from Cucumber","ecosystem":"go","ecosystems":["go","hex","maven","npm","packagist","pypi","rubygems"],"primary_language":"C#","languages":[],"topics":["dotnet","elixir","go","java","javascript","perl","php","polyglot-release","ruby","tidelift"],"license_spdx":"MIT","license_state":"standard","stars":40,"forks":24,"watchers":68,"monthly_downloads":30116305,"latest_score":79,"latest_band":"good","latest_scanned_at":"2026-07-13T21:42:33.390568Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":35904,"full_name":"AppAndFlow/react-native-safe-area-context","url":"https://github.com/AppAndFlow/react-native-safe-area-context","description":"A flexible way to handle safe area insets in JS. Also works on Android and Web! ","ecosystem":"npm","ecosystems":["npm","maven","rubygems"],"primary_language":"TypeScript","languages":["TypeScript","Objective-C","Kotlin"],"topics":["react-native","ios","android","web","react","safeareainsets","react-native-web","expo-web","safe-area","view"],"license_spdx":"MIT","license_state":"standard","stars":2743,"forks":252,"watchers":14,"monthly_downloads":29828262,"latest_score":74,"latest_band":"good","latest_scanned_at":"2026-07-22T20:22:16.568327Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"badge_url":""},{"id":30871,"full_name":"apache/airflow","url":"https://github.com/apache/airflow","description":"Apache Airflow - A platform to programmatically author, schedule, and monitor workflows","ecosystem":"pypi","ecosystems":["pypi","npm","go","maven"],"primary_language":"Python","languages":["Python"],"topics":["airflow","apache","apache-airflow","python","scheduler","workflow","automation","dag","data-engineering","data-integration","data-orchestrator","data-pipelines","data-science","elt","etl","machine-learning","mlops","orchestration","workflow-engine","workflow-orchestration","data","pipelines"],"license_spdx":"Apache-2.0","license_state":"standard","stars":46191,"forks":17407,"watchers":781,"monthly_downloads":28891797,"latest_score":93,"latest_band":"excellent","latest_scanned_at":"2026-07-21T02:34:57.958196Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":390,"median":56,"p25":46,"p75":65},{"label":"100 – 999","repositories":195,"median":70,"p25":60,"p75":75},{"label":"1,000 – 9,999","repositories":151,"median":74,"p25":65,"p75":80},{"label":"10,000 and more","repositories":142,"median":74,"p25":58,"p75":81}],"popularity_downloads":[{"label":"Under 10K / month","repositories":133,"median":56,"p25":49,"p75":67},{"label":"10K – 1M","repositories":80,"median":69,"p25":63,"p75":75},{"label":"1M – 100M","repositories":31,"median":79,"p25":73,"p75":83},{"label":"100M and more","repositories":1,"median":40,"p25":40,"p75":40}],"freshness":[{"label":"Pushed within 30 days","repositories":740},{"label":"31 – 90 days","repositories":34},{"label":"91 – 365 days","repositories":31},{"label":"Over a year","repositories":73}],"median_days_since_push":1,"dependencies":{"basis":701,"median_direct":14,"median_indirect":62,"median_total":130,"buckets":[{"label":"0","repositories":84},{"label":"1 – 5","repositories":19},{"label":"6 – 20","repositories":51},{"label":"21 – 50","repositories":82},{"label":"51 – 200","repositories":160},{"label":"201 – 500","repositories":96},{"label":"501 – 1,000","repositories":67},{"label":"Over 1,000","repositories":142}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":846,"inconclusive_share":0.0},{"name":"Fuzzing","mean":0.7,"measured":845,"inconclusive_share":0.0012},{"name":"Signed-Releases","mean":0.7,"measured":274,"inconclusive_share":0.6761},{"name":"Branch-Protection","mean":1.8,"measured":567,"inconclusive_share":0.3298},{"name":"Token-Permissions","mean":1.8,"measured":692,"inconclusive_share":0.182},{"name":"Pinned-Dependencies","mean":1.9,"measured":720,"inconclusive_share":0.1489},{"name":"SAST","mean":2.5,"measured":844,"inconclusive_share":0.0024},{"name":"Code-Review","mean":3.3,"measured":840,"inconclusive_share":0.0071},{"name":"Security-Policy","mean":3.5,"measured":846,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":4.7,"measured":846,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":5.2,"measured":846,"inconclusive_share":0.0},{"name":"CI-Tests","mean":7.2,"measured":652,"inconclusive_share":0.2293},{"name":"Maintained","mean":7.2,"measured":846,"inconclusive_share":0.0},{"name":"Contributors","mean":7.6,"measured":846,"inconclusive_share":0.0},{"name":"Binary-Artifacts","mean":8.6,"measured":845,"inconclusive_share":0.0012},{"name":"License","mean":9.2,"measured":846,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.5,"measured":692,"inconclusive_share":0.182},{"name":"Packaging","mean":10.0,"measured":318,"inconclusive_share":0.6241}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":43,"repositories":878,"share":0.049,"share_of_record":0.049},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":26,"repositories":803,"share":0.0324,"share_of_record":0.0296},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":1,"repositories":151,"share":0.0066,"share_of_record":0.0011},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":1,"repositories":79,"share":0.0127,"share_of_record":0.0011}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[21,35,40,25,31,36,73,125,171,321]},{"key":"community","name":"Community & Adoption","bins":[7,33,63,107,87,125,95,158,124,79]},{"key":"governance","name":"Sustainability & Governance","bins":[0,5,13,65,73,166,226,207,116,7]},{"key":"engineering","name":"Engineering Quality","bins":[1,7,17,55,74,98,209,228,126,63]},{"key":"security","name":"Security","bins":[15,28,82,157,177,223,105,67,21,3]},{"key":"ai_readiness","name":"AI Readiness","bins":[4,5,29,107,288,125,134,125,53,8]}],"downloads_top1pct_share":0.6586}