{"ecosystem":"npm","ecosystem_label":"npm","indexed_repositories":19883,"inspected_repositories":19884,"monthly_downloads":471931202473,"median_score":67,"share_good_or_better":0.5315,"computed_at":"2026-09-09T02:55:19.253658Z","bands":[{"band":"exceptional","repositories":1576,"monthly_downloads":55636974507},{"band":"excellent","repositories":4442,"monthly_downloads":68948412728},{"band":"good","repositories":4551,"monthly_downloads":69847207121},{"band":"moderate","repositories":4727,"monthly_downloads":92252787118},{"band":"weak","repositories":2321,"monthly_downloads":92442442045},{"band":"at_risk","repositories":1708,"monthly_downloads":82109884527},{"band":"critical","repositories":559,"monthly_downloads":10693494427}],"histogram":[{"start":0,"count":17},{"start":5,"count":47},{"start":10,"count":141},{"start":15,"count":354},{"start":20,"count":329},{"start":25,"count":579},{"start":30,"count":800},{"start":35,"count":674},{"start":40,"count":672},{"start":45,"count":975},{"start":50,"count":1564},{"start":55,"count":1514},{"start":60,"count":1649},{"start":65,"count":1739},{"start":70,"count":1136},{"start":75,"count":1676},{"start":80,"count":1975},{"start":85,"count":1543},{"start":90,"count":1623},{"start":95,"count":877}],"categories":[{"key":"vitality","name":"Vitality","median":76,"record_median":70,"repositories":19883},{"key":"community","name":"Community & Adoption","median":49,"record_median":46,"repositories":19883},{"key":"governance","name":"Sustainability & Governance","median":60,"record_median":59,"repositories":19883},{"key":"engineering","name":"Engineering Quality","median":70,"record_median":65,"repositories":19883},{"key":"security","name":"Security","median":50,"record_median":47,"repositories":19883},{"key":"ai_readiness","name":"AI Readiness","median":59,"record_median":53,"repositories":19883}],"practices":[{"key":"readme","label":"README","share":0.956,"repositories":19884},{"key":"license","label":"License detected","share":0.9035,"repositories":19884},{"key":"ci","label":"CI workflows","share":0.864,"repositories":19884},{"key":"tests","label":"Automated tests","share":0.8736,"repositories":19884},{"key":"linter","label":"Linter configuration","share":0.5818,"repositories":19884},{"key":"docs_dir","label":"Documentation directory","share":0.4466,"repositories":19884},{"key":"contributing","label":"Contributing guide","share":0.424,"repositories":19884},{"key":"security_policy","label":"Security policy","share":0.2357,"repositories":19884},{"key":"code_of_conduct","label":"Code of conduct","share":0.2679,"repositories":19884},{"key":"agent_instructions","label":"AI agent instructions","share":0.354,"repositories":19884},{"key":"bootstrap","label":"One-command bootstrap","share":0.1823,"repositories":19884},{"key":"llms_txt","label":"llms.txt","share":0.1001,"repositories":19884}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":12209,"median_score":73},{"key":"user","label":"Personal accounts","repositories":7675,"median_score":57}],"bus_factor":[{"bucket":"1","repositories":14839},{"bucket":"2","repositories":2975},{"bucket":"3–5","repositories":1659},{"bucket":"6+","repositories":293}],"single_maintainer_share":0.7507,"single_maintainer_high_reliance":1954,"licenses":[{"license":"MIT","state":"standard","repositories":10862},{"license":"Apache-2.0","state":"standard","repositories":3213},{"license":null,"state":"absent","repositories":1919},{"license":null,"state":"custom","repositories":1847},{"license":"AGPL-3.0","state":"standard","repositories":487},{"license":"GPL-3.0","state":"standard","repositories":398},{"license":"BSD-3-Clause","state":"standard","repositories":316},{"license":"ISC","state":"standard","repositories":223},{"license":"MPL-2.0","state":"standard","repositories":117},{"license":"GPL-2.0","state":"standard","repositories":100}],"ecosystems":[],"top_repositories":[{"id":4630,"full_name":"typescript-eslint/typescript-eslint","url":"https://github.com/typescript-eslint/typescript-eslint","description":":sparkles: Monorepo for all the tooling which enables ESLint to support TypeScript","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript"],"topics":["typescript","eslint","eslint-plugin","tslint","eslintplugin","plugin","estree","ast","ecmascript","javascript","parser","syntax"],"license_spdx":"MIT","license_state":"standard","stars":16374,"forks":2978,"watchers":88,"monthly_downloads":3802611005,"latest_score":99,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T21:50:51.949769Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/typescript-eslint/typescript-eslint?v=a9f19ad7-1","icon_source_type":"homepage","badge_url":""},{"id":35120,"full_name":"npm/node-semver","url":"https://github.com/npm/node-semver","description":"The semver parser for node (the one npm uses)","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["npm-cli"],"license_spdx":"ISC","license_state":"standard","stars":5459,"forks":597,"watchers":99,"monthly_downloads":3519531457,"latest_score":90,"latest_band":"excellent","latest_scanned_at":"2026-08-29T15:30:37.849291Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/npm/node-semver?v=10fa8041-1","icon_source_type":"avatar","badge_url":""},{"id":35118,"full_name":"jridgewell/sourcemaps","url":"https://github.com/jridgewell/sourcemaps","description":"Monorepo for various sourcemap libraries","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript","JavaScript"],"topics":["source","map","remap","sourcemap","vlq"],"license_spdx":null,"license_state":"absent","stars":52,"forks":9,"watchers":3,"monthly_downloads":3343551524,"latest_score":53,"latest_band":"moderate","latest_scanned_at":"2026-08-29T15:19:05.820913Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/jridgewell/sourcemaps?v=425d335a-1","icon_source_type":"avatar","badge_url":""},{"id":12372,"full_name":"babel/babel","url":"https://github.com/babel/babel","description":"🐠 Babel is a compiler for writing next generation JavaScript.","ecosystem":"npm","ecosystems":["npm"],"primary_language":"TypeScript","languages":["TypeScript","JavaScript"],"topics":["babel","javascript","ast","compiler","flavortown","es6","es2015","6to5","transpile","transpiler","babel-cli","classes","const","harmony","let","modules","var","babel-core","eslint","eslintplugin","eslint-plugin","babel-eslint","compat-table","compat-data","external-helpers"],"license_spdx":"MIT","license_state":"standard","stars":43987,"forks":5980,"watchers":827,"monthly_downloads":3312480697,"latest_score":98,"latest_band":"exceptional","latest_scanned_at":"2026-08-27T21:50:18.001736Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/babel/babel?v=2e12d950-1","icon_source_type":"homepage","badge_url":""},{"id":35179,"full_name":"eslint/js","url":"https://github.com/eslint/js","description":"Monorepo for the JS language tools.","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["ast","ecmascript","javascript","parser","syntax","acorn","eslint"],"license_spdx":"BSD-2-Clause","license_state":"standard","stars":2387,"forks":233,"watchers":52,"monthly_downloads":3122054589,"latest_score":94,"latest_band":"exceptional","latest_scanned_at":"2026-08-29T15:31:40.049734Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/eslint/js?v=09c6270e-1","icon_source_type":"readme","badge_url":""},{"id":35125,"full_name":"isaacs/minimatch","url":"https://github.com/isaacs/minimatch","description":"a glob matcher in javascript","ecosystem":"npm","ecosystems":["npm"],"primary_language":"JavaScript","languages":["JavaScript","TypeScript"],"topics":[],"license_spdx":"BlueOak-1.0.0","license_state":"standard","stars":3518,"forks":383,"watchers":58,"monthly_downloads":2931290995,"latest_score":77,"latest_band":"good","latest_scanned_at":"2026-08-29T15:30:55.075535Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/isaacs/minimatch?v=fd8fe35b-1","icon_source_type":"avatar","badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":12716,"median":60,"p25":47,"p75":73},{"label":"100 – 999","repositories":3832,"median":78,"p25":62,"p75":87},{"label":"1,000 – 9,999","repositories":2449,"median":86,"p25":69,"p75":92},{"label":"10,000 and more","repositories":887,"median":93,"p25":83,"p75":96}],"popularity_downloads":[{"label":"Under 10K / month","repositories":7058,"median":60,"p25":48,"p75":73},{"label":"10K – 1M","repositories":4554,"median":77,"p25":60,"p75":86},{"label":"1M – 100M","repositories":1768,"median":83,"p25":60,"p75":93},{"label":"100M and more","repositories":1120,"median":51,"p25":35,"p75":77}],"freshness":[{"label":"Pushed within 30 days","repositories":16072},{"label":"31 – 90 days","repositories":1508},{"label":"91 – 365 days","repositories":923},{"label":"Over a year","repositories":1381}],"median_days_since_push":3,"dependencies":{"basis":14085,"median_direct":6,"median_indirect":496,"median_total":508,"buckets":[{"label":"0","repositories":271},{"label":"1 – 5","repositories":600},{"label":"6 – 20","repositories":1156},{"label":"21 – 50","repositories":777},{"label":"51 – 200","repositories":1488},{"label":"201 – 500","repositories":2676},{"label":"501 – 1,000","repositories":3152},{"label":"Over 1,000","repositories":3965}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":19729,"inconclusive_share":0.0006},{"name":"Fuzzing","mean":0.4,"measured":19737,"inconclusive_share":0.0002},{"name":"Signed-Releases","mean":0.7,"measured":4329,"inconclusive_share":0.7807},{"name":"Branch-Protection","mean":1.4,"measured":15083,"inconclusive_share":0.2359},{"name":"SAST","mean":1.9,"measured":19720,"inconclusive_share":0.001},{"name":"Token-Permissions","mean":1.9,"measured":16591,"inconclusive_share":0.1595},{"name":"Code-Review","mean":2.2,"measured":19632,"inconclusive_share":0.0055},{"name":"Pinned-Dependencies","mean":2.2,"measured":16911,"inconclusive_share":0.1433},{"name":"Security-Policy","mean":3.0,"measured":19740,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":3.8,"measured":19705,"inconclusive_share":0.0018},{"name":"Dependency-Update-Tool","mean":4.8,"measured":19740,"inconclusive_share":0.0},{"name":"Contributors","mean":6.3,"measured":19740,"inconclusive_share":0.0},{"name":"Maintained","mean":6.4,"measured":19740,"inconclusive_share":0.0},{"name":"CI-Tests","mean":7.0,"measured":15393,"inconclusive_share":0.2202},{"name":"License","mean":8.9,"measured":19740,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.6,"measured":16591,"inconclusive_share":0.1595},{"name":"Binary-Artifacts","mean":9.7,"measured":19740,"inconclusive_share":0.0},{"name":"Packaging","mean":10.0,"measured":6640,"inconclusive_share":0.6636}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":1200,"repositories":19883,"share":0.0604,"share_of_record":0.0604},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":274,"repositories":17687,"share":0.0155,"share_of_record":0.0138},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":64,"repositories":12583,"share":0.0051,"share_of_record":0.0032},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":4,"repositories":433,"share":0.0092,"share_of_record":0.0002}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[79,846,1110,864,915,1233,2248,3914,4555,4119]},{"key":"community","name":"Community & Adoption","bins":[72,699,1857,3821,3514,2961,2563,2119,1449,828]},{"key":"governance","name":"Sustainability & Governance","bins":[1,75,219,1588,2298,5381,4943,3215,1861,302]},{"key":"engineering","name":"Engineering Quality","bins":[30,143,478,1132,1517,2317,4059,4971,3761,1475]},{"key":"security","name":"Security","bins":[60,286,1298,3083,4743,5133,3261,1653,331,35]},{"key":"ai_readiness","name":"AI Readiness","bins":[55,492,967,1766,2970,3756,3634,3334,2380,529]}],"downloads_top1pct_share":0.4252}