{"ecosystem":"npm","ecosystem_label":"npm","indexed_repositories":28454,"inspected_repositories":28453,"monthly_downloads":516110393039,"median_score":65,"share_good_or_better":0.5218,"computed_at":"2026-10-16T10:52:22.555216Z","bands":[{"band":"exceptional","repositories":1922,"monthly_downloads":60325339181},{"band":"excellent","repositories":6262,"monthly_downloads":73226580821},{"band":"good","repositories":6664,"monthly_downloads":76312248058},{"band":"moderate","repositories":6647,"monthly_downloads":89858678409},{"band":"weak","repositories":3391,"monthly_downloads":106573204922},{"band":"at_risk","repositories":2610,"monthly_downloads":94935007517},{"band":"critical","repositories":957,"monthly_downloads":14879334131}],"histogram":[{"start":0,"count":19},{"start":5,"count":77},{"start":10,"count":217},{"start":15,"count":644},{"start":20,"count":550},{"start":25,"count":846},{"start":30,"count":1214},{"start":35,"count":1017},{"start":40,"count":1065},{"start":45,"count":1309},{"start":50,"count":2170},{"start":55,"count":2132},{"start":60,"count":2345},{"start":65,"count":2530},{"start":70,"count":1678},{"start":75,"count":2456},{"start":80,"count":2926},{"start":85,"count":2143},{"start":90,"count":2077},{"start":95,"count":1038}],"categories":[{"key":"vitality","name":"Vitality","median":73,"record_median":68,"repositories":28454},{"key":"community","name":"Community & Adoption","median":49,"record_median":45,"repositories":28454},{"key":"governance","name":"Sustainability & Governance","median":59,"record_median":58,"repositories":28454},{"key":"engineering","name":"Engineering Quality","median":70,"record_median":66,"repositories":28454},{"key":"security","name":"Security","median":52,"record_median":49,"repositories":28454},{"key":"ai_readiness","name":"AI Readiness","median":61,"record_median":56,"repositories":28454}],"practices":[{"key":"readme","label":"README","share":0.9551,"repositories":28453},{"key":"license","label":"License detected","share":0.9058,"repositories":28453},{"key":"ci","label":"CI workflows","share":0.8582,"repositories":28453},{"key":"tests","label":"Automated tests","share":0.8733,"repositories":28453},{"key":"linter","label":"Linter configuration","share":0.6106,"repositories":28453},{"key":"docs_dir","label":"Documentation directory","share":0.431,"repositories":28453},{"key":"contributing","label":"Contributing guide","share":0.408,"repositories":28453},{"key":"security_policy","label":"Security policy","share":0.2289,"repositories":28453},{"key":"code_of_conduct","label":"Code of conduct","share":0.2588,"repositories":28453},{"key":"agent_instructions","label":"AI agent instructions","share":0.3377,"repositories":28453},{"key":"bootstrap","label":"One-command bootstrap","share":0.1729,"repositories":28453},{"key":"llms_txt","label":"llms.txt","share":0.2262,"repositories":28453}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":17083,"median_score":73},{"key":"user","label":"Personal accounts","repositories":11370,"median_score":59}],"bus_factor":[{"bucket":"1","repositories":21883},{"bucket":"2","repositories":4004},{"bucket":"3–5","repositories":2043},{"bucket":"6+","repositories":370}],"single_maintainer_share":0.7733,"single_maintainer_high_reliance":2979,"licenses":[{"license":"MIT","state":"standard","repositories":15927},{"license":"Apache-2.0","state":"standard","repositories":4451},{"license":null,"state":"absent","repositories":2680},{"license":null,"state":"custom","repositories":2551},{"license":"AGPL-3.0","state":"standard","repositories":666},{"license":"GPL-3.0","state":"standard","repositories":538},{"license":"BSD-3-Clause","state":"standard","repositories":411},{"license":"ISC","state":"standard","repositories":346},{"license":"MPL-2.0","state":"standard","repositories":177},{"license":"GPL-2.0","state":"standard","repositories":123}],"ecosystems":[],"top_repositories":[{"id":4630,"full_name":"typescript-eslint/typescript-eslint","url":"https://github.com/typescript-eslint/typescript-eslint","description":":sparkles: Monorepo for all the tooling which enables ESLint to support TypeScript","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript"],"topics":["typescript","eslint","eslint-plugin","tslint","eslintplugin","plugin","estree","ast","ecmascript","javascript","parser","syntax"],"license_spdx":"MIT","license_state":"standard","stars":16374,"forks":2978,"watchers":88,"monthly_downloads":3802611005,"latest_score":99,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T21:50:51.949769Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/typescript-eslint/typescript-eslint?v=a9f19ad7-1","icon_source_type":"homepage","badge_url":""},{"id":35120,"full_name":"npm/node-semver","url":"https://github.com/npm/node-semver","description":"The semver parser for node (the one npm uses)","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["npm-cli"],"license_spdx":"ISC","license_state":"standard","stars":5459,"forks":597,"watchers":99,"monthly_downloads":3519531457,"latest_score":90,"latest_band":"excellent","latest_scanned_at":"2026-08-29T15:30:37.849291Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/npm/node-semver?v=10fa8041-1","icon_source_type":"avatar","badge_url":""},{"id":35118,"full_name":"jridgewell/sourcemaps","url":"https://github.com/jridgewell/sourcemaps","description":"Monorepo for various sourcemap libraries","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript","JavaScript"],"topics":["source","map","remap","sourcemap","vlq"],"license_spdx":null,"license_state":"absent","stars":52,"forks":9,"watchers":3,"monthly_downloads":3343551524,"latest_score":53,"latest_band":"moderate","latest_scanned_at":"2026-08-29T15:19:05.820913Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/jridgewell/sourcemaps?v=425d335a-1","icon_source_type":"avatar","badge_url":""},{"id":12372,"full_name":"babel/babel","url":"https://github.com/babel/babel","description":"🐠 Babel is a compiler for writing next generation JavaScript.","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript","JavaScript"],"topics":["babel","javascript","ast","compiler","flavortown","es6","es2015","6to5","transpile","transpiler","babel-cli","classes","const","harmony","let","modules","var","babel-core","eslint","eslintplugin","eslint-plugin","babel-eslint","compat-table","compat-data","external-helpers"],"license_spdx":"MIT","license_state":"standard","stars":43987,"forks":5980,"watchers":827,"monthly_downloads":3312480697,"latest_score":98,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T21:50:18.001736Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/babel/babel?v=2e12d950-1","icon_source_type":"homepage","badge_url":""},{"id":35179,"full_name":"eslint/js","url":"https://github.com/eslint/js","description":"Monorepo for the JS language tools.","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["ast","ecmascript","javascript","parser","syntax","acorn","eslint"],"license_spdx":"BSD-2-Clause","license_state":"standard","stars":2387,"forks":233,"watchers":52,"monthly_downloads":3122054589,"latest_score":94,"latest_band":"exceptional","latest_scanned_at":"2026-08-29T15:31:40.049734Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/eslint/js?v=09c6270e-1","icon_source_type":"readme","badge_url":""},{"id":35125,"full_name":"isaacs/minimatch","url":"https://github.com/isaacs/minimatch","description":"a glob matcher in javascript","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript","TypeScript"],"topics":[],"license_spdx":"BlueOak-1.0.0","license_state":"standard","stars":3518,"forks":383,"watchers":58,"monthly_downloads":2931290995,"latest_score":77,"latest_band":"good","latest_scanned_at":"2026-08-29T15:30:55.075535Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/isaacs/minimatch?v=fd8fe35b-1","icon_source_type":"avatar","badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":18809,"median":60,"p25":45,"p75":73},{"label":"100 – 999","repositories":5601,"median":77,"p25":60,"p75":87},{"label":"1,000 – 9,999","repositories":3029,"median":86,"p25":69,"p75":92},{"label":"10,000 and more","repositories":1014,"median":92,"p25":84,"p75":96}],"popularity_downloads":[{"label":"Under 10K / month","repositories":10484,"median":62,"p25":48,"p75":75},{"label":"10K – 1M","repositories":7470,"median":75,"p25":59,"p75":86},{"label":"1M – 100M","repositories":3009,"median":77,"p25":48,"p75":90},{"label":"100M and more","repositories":1224,"median":50,"p25":35,"p75":77}],"freshness":[{"label":"Pushed within 30 days","repositories":19324},{"label":"31 – 90 days","repositories":5680},{"label":"91 – 365 days","repositories":1404},{"label":"Over a year","repositories":2045}],"median_days_since_push":7,"dependencies":{"basis":20454,"median_direct":6,"median_indirect":455,"median_total":464,"buckets":[{"label":"0","repositories":397},{"label":"1 – 5","repositories":972},{"label":"6 – 20","repositories":1880},{"label":"21 – 50","repositories":1141},{"label":"51 – 200","repositories":2264},{"label":"201 – 500","repositories":4033},{"label":"501 – 1,000","repositories":4572},{"label":"Over 1,000","repositories":5195}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":28106,"inconclusive_share":0.0026},{"name":"Fuzzing","mean":0.4,"measured":28154,"inconclusive_share":0.0009},{"name":"Signed-Releases","mean":0.7,"measured":5968,"inconclusive_share":0.7882},{"name":"Branch-Protection","mean":1.4,"measured":21588,"inconclusive_share":0.2339},{"name":"SAST","mean":1.8,"measured":28119,"inconclusive_share":0.0022},{"name":"Token-Permissions","mean":2.0,"measured":23595,"inconclusive_share":0.1627},{"name":"Code-Review","mean":2.1,"measured":28002,"inconclusive_share":0.0063},{"name":"Pinned-Dependencies","mean":2.4,"measured":24072,"inconclusive_share":0.1458},{"name":"Security-Policy","mean":2.9,"measured":28180,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":3.5,"measured":28136,"inconclusive_share":0.0016},{"name":"Dependency-Update-Tool","mean":4.8,"measured":28180,"inconclusive_share":0.0},{"name":"Contributors","mean":6.3,"measured":28179,"inconclusive_share":0.0},{"name":"Maintained","mean":6.4,"measured":28180,"inconclusive_share":0.0},{"name":"CI-Tests","mean":6.8,"measured":22313,"inconclusive_share":0.2082},{"name":"License","mean":9.0,"measured":28180,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.6,"measured":23595,"inconclusive_share":0.1627},{"name":"Binary-Artifacts","mean":9.7,"measured":28180,"inconclusive_share":0.0},{"name":"Packaging","mean":10.0,"measured":9242,"inconclusive_share":0.672}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":2068,"repositories":28454,"share":0.0727,"share_of_record":0.0727},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":450,"repositories":25546,"share":0.0176,"share_of_record":0.0158},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":104,"repositories":22849,"share":0.0046,"share_of_record":0.0037},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":5,"repositories":445,"share":0.0112,"share_of_record":0.0002}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[141,1403,1767,1193,1537,2615,3740,4924,6070,5064]},{"key":"community","name":"Community & Adoption","bins":[108,971,2701,5234,5332,4649,3817,2892,1788,962]},{"key":"governance","name":"Sustainability & Governance","bins":[1,78,293,2166,3305,8413,7567,4330,1999,302]},{"key":"engineering","name":"Engineering Quality","bins":[37,201,676,1639,2144,3461,5674,7053,5434,2135]},{"key":"security","name":"Security","bins":[68,307,1502,3761,6660,7718,5268,2507,587,76]},{"key":"ai_readiness","name":"AI Readiness","bins":[53,702,1208,2182,3834,5103,5977,4795,3599,1001]}],"downloads_top1pct_share":0.4689}