{"ecosystem":"npm","ecosystem_label":"npm","indexed_repositories":10780,"inspected_repositories":10773,"monthly_downloads":319835813529,"median_score":60,"share_good_or_better":0.257,"computed_at":"2026-07-23T09:11:11.369817Z","bands":[{"band":"excellent","repositories":228,"monthly_downloads":5249708150},{"band":"good","repositories":2541,"monthly_downloads":45838657992},{"band":"moderate","repositories":5419,"monthly_downloads":115723910632},{"band":"at_risk","repositories":2139,"monthly_downloads":114888285064},{"band":"critical","repositories":446,"monthly_downloads":38135251691}],"histogram":[{"start":0,"count":0},{"start":5,"count":10},{"start":10,"count":44},{"start":15,"count":77},{"start":20,"count":102},{"start":25,"count":213},{"start":30,"count":323},{"start":35,"count":446},{"start":40,"count":536},{"start":45,"count":834},{"start":50,"count":1156},{"start":55,"count":1414},{"start":60,"count":1473},{"start":65,"count":1376},{"start":70,"count":1187},{"start":75,"count":818},{"start":80,"count":536},{"start":85,"count":206},{"start":90,"count":21},{"start":95,"count":1}],"categories":[{"key":"vitality","name":"Vitality","median":79,"record_median":73,"repositories":10777},{"key":"community","name":"Community & Adoption","median":49,"record_median":46,"repositories":10777},{"key":"governance","name":"Sustainability & Governance","median":59,"record_median":59,"repositories":10777},{"key":"engineering","name":"Engineering Quality","median":70,"record_median":66,"repositories":10777},{"key":"security","name":"Security","median":46,"record_median":45,"repositories":10777},{"key":"ai_readiness","name":"AI Readiness","median":52,"record_median":46,"repositories":10777}],"practices":[{"key":"readme","label":"README","share":0.9671,"repositories":10773},{"key":"license","label":"License detected","share":0.904,"repositories":10773},{"key":"ci","label":"CI workflows","share":0.8765,"repositories":10773},{"key":"tests","label":"Automated tests","share":0.881,"repositories":10773},{"key":"linter","label":"Linter configuration","share":0.5845,"repositories":10773},{"key":"docs_dir","label":"Documentation directory","share":0.468,"repositories":10773},{"key":"contributing","label":"Contributing guide","share":0.4445,"repositories":10773},{"key":"security_policy","label":"Security policy","share":0.2511,"repositories":10773},{"key":"code_of_conduct","label":"Code of conduct","share":0.285,"repositories":10773},{"key":"agent_instructions","label":"AI agent instructions","share":0.3874,"repositories":10773},{"key":"bootstrap","label":"One-command bootstrap","share":0.1935,"repositories":10773},{"key":"llms_txt","label":"llms.txt","share":0.0391,"repositories":10773}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":6889,"median_score":64},{"key":"user","label":"Personal accounts","repositories":3884,"median_score":55}],"bus_factor":[{"bucket":"1","repositories":7644},{"bucket":"2","repositories":1815},{"bucket":"3–5","repositories":1029},{"bucket":"6+","repositories":225}],"single_maintainer_share":0.7135,"single_maintainer_high_reliance":884,"licenses":[{"license":"MIT","state":"standard","repositories":5796},{"license":"Apache-2.0","state":"standard","repositories":1769},{"license":null,"state":"custom","repositories":1066},{"license":null,"state":"absent","repositories":1034},{"license":"AGPL-3.0","state":"standard","repositories":288},{"license":"GPL-3.0","state":"standard","repositories":237},{"license":"BSD-3-Clause","state":"standard","repositories":167},{"license":"ISC","state":"standard","repositories":82},{"license":"MPL-2.0","state":"standard","repositories":65},{"license":"GPL-2.0","state":"standard","repositories":62}],"ecosystems":[],"top_repositories":[{"id":35121,"full_name":"chalk/ansi-regex","url":"https://github.com/chalk/ansi-regex","description":"Regular expression for matching ANSI escape codes","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["ansi","styles","color","colour","colors","terminal","console","cli","string","tty","escape","formatting","rgb","256","shell","xterm","command-line","text","regex","regexp","re","match","test","find","pattern"],"license_spdx":"MIT","license_state":"standard","stars":202,"forks":91,"watchers":14,"monthly_downloads":2124647308,"latest_score":49,"latest_band":"at_risk","latest_scanned_at":"2026-07-22T15:44:02.935162Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"badge_url":""},{"id":35113,"full_name":"vercel/ms","url":"https://github.com/vercel/ms","description":"Tiny millisecond conversion utility","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript"],"topics":["milliseconds","conversion","utility"],"license_spdx":"MIT","license_state":"standard","stars":5541,"forks":329,"watchers":78,"monthly_downloads":2081725518,"latest_score":66,"latest_band":"moderate","latest_scanned_at":"2026-07-22T15:42:03.079717Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"badge_url":""},{"id":12366,"full_name":"isaacs/node-lru-cache","url":"https://github.com/isaacs/node-lru-cache","description":"A fast cache that automatically deletes the least recently used items","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript","TypeScript"],"topics":["cache","caching","lru","lru-cache","lrucache","mru"],"license_spdx":"BlueOak-1.0.0","license_state":"standard","stars":5902,"forks":368,"watchers":47,"monthly_downloads":2054766239,"latest_score":68,"latest_band":"moderate","latest_scanned_at":"2026-07-22T01:30:22.945601Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"organic","abandonment_state":"maintained","red_flags":[],"badge_url":""},{"id":12474,"full_name":"sindresorhus/string-width","url":"https://github.com/sindresorhus/string-width","description":"Get the visual width of a string - the number of columns required to display it","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["string","character","unicode","width","visual","column","columns","fullwidth","full-width","wcwidth","wcswidth","full","ansi","escape","codes","cli","command-line","terminal","console","cjk","chinese","japanese","korean","fixed-width","east-asian-width"],"license_spdx":"MIT","license_state":"standard","stars":529,"forks":45,"watchers":10,"monthly_downloads":2032163617,"latest_score":60,"latest_band":"moderate","latest_scanned_at":"2026-07-17T04:50:39.771803Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":35152,"full_name":"chalk/supports-color","url":"https://github.com/chalk/supports-color","description":"Detect whether a terminal supports color","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["color","colour","colors","terminal","console","cli","ansi","styles","tty","rgb","256","shell","xterm","command-line","support","supports","capability","detect","truecolor","16m"],"license_spdx":"MIT","license_state":"standard","stars":370,"forks":94,"watchers":11,"monthly_downloads":1917989391,"latest_score":49,"latest_band":"at_risk","latest_scanned_at":"2026-07-22T15:53:19.848790Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"dormant","red_flags":[],"badge_url":""},{"id":35129,"full_name":"chalk/chalk","url":"https://github.com/chalk/chalk","description":"🖍 Terminal string styling done right","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript","TypeScript"],"topics":["ansi-escape-codes","javascript","chalk","ansi","color","cli","terminal","console","terminal-emulators","commandline","strip-ansi","colour","colors","string","style","styles","tty","formatting","rgb","256","shell","xterm","log","logging","command-line","text"],"license_spdx":"MIT","license_state":"standard","stars":23285,"forks":1017,"watchers":141,"monthly_downloads":1835428382,"latest_score":59,"latest_band":"moderate","latest_scanned_at":"2026-07-22T15:46:32.830725Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":6793,"median":56,"p25":47,"p75":63},{"label":"100 – 999","repositories":2097,"median":66,"p25":56,"p75":73},{"label":"1,000 – 9,999","repositories":1276,"median":72,"p25":65,"p75":78},{"label":"10,000 and more","repositories":607,"median":79,"p25":72,"p75":84}],"popularity_downloads":[{"label":"Under 10K / month","repositories":4031,"median":57,"p25":48,"p75":65},{"label":"10K – 1M","repositories":1998,"median":65,"p25":56,"p75":72},{"label":"1M – 100M","repositories":614,"median":73,"p25":63,"p75":80},{"label":"100M and more","repositories":706,"median":49,"p25":38,"p75":62}],"freshness":[{"label":"Pushed within 30 days","repositories":9343},{"label":"31 – 90 days","repositories":280},{"label":"91 – 365 days","repositories":472},{"label":"Over a year","repositories":678}],"median_days_since_push":1,"dependencies":{"basis":7030,"median_direct":5,"median_indirect":510,"median_total":522,"buckets":[{"label":"0","repositories":130},{"label":"1 – 5","repositories":332},{"label":"6 – 20","repositories":585},{"label":"21 – 50","repositories":395},{"label":"51 – 200","repositories":696},{"label":"201 – 500","repositories":1290},{"label":"501 – 1,000","repositories":1511},{"label":"Over 1,000","repositories":2091}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":10648,"inconclusive_share":0.0012},{"name":"Fuzzing","mean":0.4,"measured":10657,"inconclusive_share":0.0004},{"name":"Signed-Releases","mean":0.7,"measured":2481,"inconclusive_share":0.7673},{"name":"Branch-Protection","mean":1.6,"measured":8093,"inconclusive_share":0.2409},{"name":"Token-Permissions","mean":1.7,"measured":9075,"inconclusive_share":0.1488},{"name":"SAST","mean":1.9,"measured":10650,"inconclusive_share":0.001},{"name":"Pinned-Dependencies","mean":2.2,"measured":9241,"inconclusive_share":0.1332},{"name":"Code-Review","mean":2.4,"measured":10601,"inconclusive_share":0.0056},{"name":"Security-Policy","mean":3.2,"measured":10661,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":4.2,"measured":10636,"inconclusive_share":0.0023},{"name":"Dependency-Update-Tool","mean":4.8,"measured":10661,"inconclusive_share":0.0},{"name":"Contributors","mean":6.3,"measured":10661,"inconclusive_share":0.0},{"name":"Maintained","mean":6.6,"measured":10661,"inconclusive_share":0.0},{"name":"CI-Tests","mean":7.2,"measured":8281,"inconclusive_share":0.2232},{"name":"License","mean":8.9,"measured":10661,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.5,"measured":9075,"inconclusive_share":0.1488},{"name":"Binary-Artifacts","mean":9.7,"measured":10660,"inconclusive_share":0.0001},{"name":"Packaging","mean":10.0,"measured":3805,"inconclusive_share":0.6431}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":352,"repositories":10779,"share":0.0327,"share_of_record":0.0327},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":282,"repositories":9531,"share":0.0296,"share_of_record":0.0262},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":8,"repositories":2218,"share":0.0036,"share_of_record":0.0007},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":4,"repositories":438,"share":0.0091,"share_of_record":0.0004}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[59,428,493,510,516,487,868,2133,2505,2778]},{"key":"community","name":"Community & Adoption","bins":[31,332,1137,2037,1890,1541,1348,1139,823,499]},{"key":"governance","name":"Sustainability & Governance","bins":[2,76,173,981,1339,2896,2728,1803,749,30]},{"key":"engineering","name":"Engineering Quality","bins":[12,63,244,592,769,1185,2175,2724,2164,849]},{"key":"security","name":"Security","bins":[50,242,1000,2327,2529,2437,1396,655,127,14]},{"key":"ai_readiness","name":"AI Readiness","bins":[46,386,664,1260,2385,1821,1372,1998,747,98]}],"downloads_top1pct_share":0.3566}