{"ecosystem":"npm","ecosystem_label":"npm","indexed_repositories":30157,"inspected_repositories":30156,"monthly_downloads":523703727657,"median_score":65,"share_good_or_better":0.5211,"computed_at":"2026-10-24T04:54:15.321472Z","bands":[{"band":"exceptional","repositories":1995,"monthly_downloads":61906217722},{"band":"excellent","repositories":6604,"monthly_downloads":75462764970},{"band":"good","repositories":7116,"monthly_downloads":77293252691},{"band":"moderate","repositories":7030,"monthly_downloads":93038306220},{"band":"weak","repositories":3598,"monthly_downloads":105123378539},{"band":"at_risk","repositories":2771,"monthly_downloads":95909044496},{"band":"critical","repositories":1042,"monthly_downloads":14970763019}],"histogram":[{"start":0,"count":20},{"start":5,"count":84},{"start":10,"count":239},{"start":15,"count":699},{"start":20,"count":593},{"start":25,"count":894},{"start":30,"count":1284},{"start":35,"count":1068},{"start":40,"count":1167},{"start":45,"count":1363},{"start":50,"count":2315},{"start":55,"count":2236},{"start":60,"count":2479},{"start":65,"count":2657},{"start":70,"count":1813},{"start":75,"count":2646},{"start":80,"count":3072},{"start":85,"count":2264},{"start":90,"count":2196},{"start":95,"count":1067}],"categories":[{"key":"vitality","name":"Vitality","median":73,"record_median":68,"repositories":30157},{"key":"community","name":"Community & Adoption","median":49,"record_median":44,"repositories":30157},{"key":"governance","name":"Sustainability & Governance","median":59,"record_median":58,"repositories":30157},{"key":"engineering","name":"Engineering Quality","median":70,"record_median":66,"repositories":30157},{"key":"security","name":"Security","median":51,"record_median":49,"repositories":30157},{"key":"ai_readiness","name":"AI Readiness","median":62,"record_median":57,"repositories":30157}],"practices":[{"key":"readme","label":"README","share":0.9542,"repositories":30156},{"key":"license","label":"License detected","share":0.9058,"repositories":30156},{"key":"ci","label":"CI workflows","share":0.8584,"repositories":30156},{"key":"tests","label":"Automated tests","share":0.8752,"repositories":30156},{"key":"linter","label":"Linter configuration","share":0.6097,"repositories":30156},{"key":"docs_dir","label":"Documentation directory","share":0.4353,"repositories":30156},{"key":"contributing","label":"Contributing guide","share":0.4076,"repositories":30156},{"key":"security_policy","label":"Security policy","share":0.2301,"repositories":30156},{"key":"code_of_conduct","label":"Code of conduct","share":0.2577,"repositories":30156},{"key":"agent_instructions","label":"AI agent instructions","share":0.3398,"repositories":30156},{"key":"bootstrap","label":"One-command bootstrap","share":0.1762,"repositories":30156},{"key":"llms_txt","label":"llms.txt","share":0.2324,"repositories":30156}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":18090,"median_score":73},{"key":"user","label":"Personal accounts","repositories":12066,"median_score":59}],"bus_factor":[{"bucket":"1","repositories":23274},{"bucket":"2","repositories":4218},{"bucket":"3–5","repositories":2125},{"bucket":"6+","repositories":377}],"single_maintainer_share":0.776,"single_maintainer_high_reliance":3074,"licenses":[{"license":"MIT","state":"standard","repositories":16848},{"license":"Apache-2.0","state":"standard","repositories":4791},{"license":null,"state":"absent","repositories":2840},{"license":null,"state":"custom","repositories":2673},{"license":"AGPL-3.0","state":"standard","repositories":701},{"license":"GPL-3.0","state":"standard","repositories":576},{"license":"BSD-3-Clause","state":"standard","repositories":437},{"license":"ISC","state":"standard","repositories":357},{"license":"MPL-2.0","state":"standard","repositories":196},{"license":"GPL-2.0","state":"standard","repositories":129}],"ecosystems":[],"top_repositories":[{"id":4630,"full_name":"typescript-eslint/typescript-eslint","url":"https://github.com/typescript-eslint/typescript-eslint","description":":sparkles: Monorepo for all the tooling which enables ESLint to support TypeScript","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript"],"topics":["typescript","eslint","eslint-plugin","tslint","eslintplugin","plugin","estree","ast","ecmascript","javascript","parser","syntax"],"license_spdx":"MIT","license_state":"standard","stars":16374,"forks":2978,"watchers":88,"monthly_downloads":3802611005,"latest_score":99,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T21:50:51.949769Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/typescript-eslint/typescript-eslint?v=a9f19ad7-1","icon_source_type":"homepage","badge_url":""},{"id":35118,"full_name":"jridgewell/sourcemaps","url":"https://github.com/jridgewell/sourcemaps","description":"Monorepo for various sourcemap libraries","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript","JavaScript"],"topics":["source","map","remap","sourcemap","vlq"],"license_spdx":null,"license_state":"absent","stars":56,"forks":12,"watchers":3,"monthly_downloads":3753533210,"latest_score":50,"latest_band":"moderate","latest_scanned_at":"2026-10-21T02:01:47.258551Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/jridgewell/sourcemaps?v=425d335a-1","icon_source_type":"avatar","badge_url":""},{"id":35120,"full_name":"npm/node-semver","url":"https://github.com/npm/node-semver","description":"The semver parser for node (the one npm uses)","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["npm-cli"],"license_spdx":"ISC","license_state":"standard","stars":5472,"forks":617,"watchers":100,"monthly_downloads":3617778352,"latest_score":89,"latest_band":"excellent","latest_scanned_at":"2026-10-21T02:12:38.301909Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/npm/node-semver?v=10fa8041-1","icon_source_type":"avatar","badge_url":""},{"id":12372,"full_name":"babel/babel","url":"https://github.com/babel/babel","description":"🐠 Babel is a compiler for writing next generation JavaScript.","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript","JavaScript"],"topics":["babel","javascript","ast","compiler","flavortown","es6","es2015","6to5","transpile","transpiler","babel-cli","classes","const","harmony","let","modules","var","babel-core","eslint","eslintplugin","eslint-plugin","babel-eslint","compat-table","compat-data","external-helpers"],"license_spdx":"MIT","license_state":"standard","stars":43987,"forks":5980,"watchers":827,"monthly_downloads":3312480697,"latest_score":98,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T21:50:18.001736Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/babel/babel?v=2e12d950-1","icon_source_type":"homepage","badge_url":""},{"id":35179,"full_name":"eslint/js","url":"https://github.com/eslint/js","description":"Monorepo for the JS language tools.","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["ast","ecmascript","javascript","parser","syntax","acorn","eslint"],"license_spdx":"BSD-2-Clause","license_state":"standard","stars":2387,"forks":235,"watchers":51,"monthly_downloads":3259534526,"latest_score":93,"latest_band":"exceptional","latest_scanned_at":"2026-10-21T02:14:31.193561Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/eslint/js?v=501faac4-1","icon_source_type":"avatar","badge_url":""},{"id":35125,"full_name":"isaacs/minimatch","url":"https://github.com/isaacs/minimatch","description":"a glob matcher in javascript","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript","TypeScript"],"topics":[],"license_spdx":"BlueOak-1.0.0","license_state":"standard","stars":3526,"forks":389,"watchers":59,"monthly_downloads":2981073769,"latest_score":75,"latest_band":"good","latest_scanned_at":"2026-10-21T02:13:51.716131Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/isaacs/minimatch?v=fd8fe35b-1","icon_source_type":"avatar","badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":20038,"median":60,"p25":45,"p75":73},{"label":"100 – 999","repositories":5926,"median":77,"p25":60,"p75":87},{"label":"1,000 – 9,999","repositories":3158,"median":86,"p25":71,"p75":92},{"label":"10,000 and more","repositories":1034,"median":92,"p25":84,"p75":96}],"popularity_downloads":[{"label":"Under 10K / month","repositories":11025,"median":62,"p25":48,"p75":75},{"label":"10K – 1M","repositories":8000,"median":73,"p25":59,"p75":86},{"label":"1M – 100M","repositories":3130,"median":77,"p25":48,"p75":90},{"label":"100M and more","repositories":1233,"median":50,"p25":34,"p75":77}],"freshness":[{"label":"Pushed within 30 days","repositories":20282},{"label":"31 – 90 days","repositories":6095},{"label":"91 – 365 days","repositories":1650},{"label":"Over a year","repositories":2129}],"median_days_since_push":7,"dependencies":{"basis":21680,"median_direct":5,"median_indirect":441,"median_total":452,"buckets":[{"label":"0","repositories":421},{"label":"1 – 5","repositories":1039},{"label":"6 – 20","repositories":2008},{"label":"21 – 50","repositories":1250},{"label":"51 – 200","repositories":2479},{"label":"201 – 500","repositories":4307},{"label":"501 – 1,000","repositories":4805},{"label":"Over 1,000","repositories":5371}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":29726,"inconclusive_share":0.0025},{"name":"Fuzzing","mean":0.4,"measured":29774,"inconclusive_share":0.0009},{"name":"Signed-Releases","mean":0.7,"measured":6376,"inconclusive_share":0.786},{"name":"Branch-Protection","mean":1.4,"measured":22899,"inconclusive_share":0.2316},{"name":"SAST","mean":1.8,"measured":29705,"inconclusive_share":0.0032},{"name":"Code-Review","mean":2.1,"measured":29605,"inconclusive_share":0.0065},{"name":"Token-Permissions","mean":2.1,"measured":24976,"inconclusive_share":0.1619},{"name":"Pinned-Dependencies","mean":2.5,"measured":25474,"inconclusive_share":0.1452},{"name":"Security-Policy","mean":2.9,"measured":29800,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":3.5,"measured":29756,"inconclusive_share":0.0015},{"name":"Dependency-Update-Tool","mean":4.8,"measured":29800,"inconclusive_share":0.0},{"name":"Contributors","mean":6.3,"measured":29799,"inconclusive_share":0.0},{"name":"Maintained","mean":6.4,"measured":29800,"inconclusive_share":0.0},{"name":"CI-Tests","mean":6.9,"measured":23587,"inconclusive_share":0.2085},{"name":"License","mean":9.0,"measured":29800,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.6,"measured":24976,"inconclusive_share":0.1619},{"name":"Binary-Artifacts","mean":9.7,"measured":29800,"inconclusive_share":0.0},{"name":"Packaging","mean":10.0,"measured":9773,"inconclusive_share":0.672}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":2223,"repositories":30157,"share":0.0737,"share_of_record":0.0737},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":482,"repositories":27094,"share":0.0178,"share_of_record":0.016},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":109,"repositories":24180,"share":0.0045,"share_of_record":0.0036},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":5,"repositories":445,"share":0.0112,"share_of_record":0.0002}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[147,1477,1842,1276,1692,2870,3981,5100,6338,5434]},{"key":"community","name":"Community & Adoption","bins":[113,1087,2916,5496,5667,4938,4070,3032,1848,990]},{"key":"governance","name":"Sustainability & Governance","bins":[1,86,305,2241,3585,8961,8049,4543,2078,308]},{"key":"engineering","name":"Engineering Quality","bins":[37,215,706,1742,2249,3664,5982,7482,5794,2286]},{"key":"security","name":"Security","bins":[81,329,1627,4030,7036,8171,5519,2675,605,84]},{"key":"ai_readiness","name":"AI Readiness","bins":[58,717,1249,2285,4044,5386,6344,5116,3845,1113]}],"downloads_top1pct_share":0.4797}