{"ecosystem":"nuget","ecosystem_label":"NuGet","indexed_repositories":576,"inspected_repositories":576,"monthly_downloads":6014293,"median_score":56,"share_good_or_better":0.1285,"computed_at":"2026-07-23T09:11:15.127039Z","bands":[{"band":"excellent","repositories":0,"monthly_downloads":0},{"band":"good","repositories":74,"monthly_downloads":1332771},{"band":"moderate","repositories":294,"monthly_downloads":4621262},{"band":"at_risk","repositories":160,"monthly_downloads":60260},{"band":"critical","repositories":48,"monthly_downloads":0}],"histogram":[{"start":0,"count":0},{"start":5,"count":2},{"start":10,"count":8},{"start":15,"count":10},{"start":20,"count":10},{"start":25,"count":18},{"start":30,"count":31},{"start":35,"count":31},{"start":40,"count":46},{"start":45,"count":52},{"start":50,"count":58},{"start":55,"count":72},{"start":60,"count":72},{"start":65,"count":92},{"start":70,"count":33},{"start":75,"count":26},{"start":80,"count":15},{"start":85,"count":0},{"start":90,"count":0},{"start":95,"count":0}],"categories":[{"key":"vitality","name":"Vitality","median":73,"record_median":73,"repositories":576},{"key":"community","name":"Community & Adoption","median":51,"record_median":46,"repositories":576},{"key":"governance","name":"Sustainability & Governance","median":59,"record_median":59,"repositories":576},{"key":"engineering","name":"Engineering Quality","median":50,"record_median":66,"repositories":576},{"key":"security","name":"Security","median":50,"record_median":45,"repositories":576},{"key":"ai_readiness","name":"AI Readiness","median":40,"record_median":46,"repositories":576}],"practices":[{"key":"readme","label":"README","share":0.9635,"repositories":576},{"key":"license","label":"License detected","share":0.9514,"repositories":576},{"key":"ci","label":"CI workflows","share":0.7517,"repositories":576},{"key":"tests","label":"Automated tests","share":0.4132,"repositories":576},{"key":"linter","label":"Linter configuration","share":0.0469,"repositories":576},{"key":"docs_dir","label":"Documentation directory","share":0.3698,"repositories":576},{"key":"contributing","label":"Contributing guide","share":0.3351,"repositories":576},{"key":"security_policy","label":"Security policy","share":0.1597,"repositories":576},{"key":"code_of_conduct","label":"Code of conduct","share":0.2483,"repositories":576},{"key":"agent_instructions","label":"AI agent instructions","share":0.2847,"repositories":576},{"key":"bootstrap","label":"One-command bootstrap","share":0.0503,"repositories":576},{"key":"llms_txt","label":"llms.txt","share":0.0382,"repositories":576}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":299,"median_score":60},{"key":"user","label":"Personal accounts","repositories":277,"median_score":52}],"bus_factor":[{"bucket":"1","repositories":442},{"bucket":"2","repositories":88},{"bucket":"3–5","repositories":39},{"bucket":"6+","repositories":6}],"single_maintainer_share":0.7687,"single_maintainer_high_reliance":1,"licenses":[{"license":"MIT","state":"standard","repositories":351},{"license":"Apache-2.0","state":"standard","repositories":72},{"license":null,"state":"custom","repositories":63},{"license":"BSD-3-Clause","state":"standard","repositories":32},{"license":null,"state":"absent","repositories":28},{"license":"MS-PL","state":"standard","repositories":7},{"license":"Unlicense","state":"standard","repositories":5},{"license":"AGPL-3.0","state":"standard","repositories":4},{"license":"GPL-3.0","state":"standard","repositories":4},{"license":"MPL-2.0","state":"standard","repositories":3}],"ecosystems":[],"top_repositories":[{"id":30693,"full_name":"pythonnet/clr-loader","url":"https://github.com/pythonnet/clr-loader","description":"Loader for different .NET runtimes","ecosystem":"pypi","ecosystems":["pypi","nuget"],"primary_language":"Python","languages":["Python"],"topics":["clr","dotnet","python","ffi"],"license_spdx":"MIT","license_state":"standard","stars":43,"forks":32,"watchers":4,"monthly_downloads":3632452,"latest_score":62,"latest_band":"moderate","latest_scanned_at":"2026-07-21T01:54:15.952565Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":23724,"full_name":"renovatebot/pgp","url":"https://github.com/renovatebot/pgp","description":"Renovate PGP library","ecosystem":"npm","ecosystems":["npm","maven","nuget"],"primary_language":"TypeScript","languages":["TypeScript","Java","JavaScript","C#"],"topics":["renovate","pgp"],"license_spdx":"Apache-2.0","license_state":"standard","stars":0,"forks":2,"watchers":0,"monthly_downloads":907231,"latest_score":66,"latest_band":"moderate","latest_scanned_at":"2026-07-18T23:50:59.130462Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":15417,"full_name":"cdxgen/cdxgen","url":"https://github.com/cdxgen/cdxgen","description":"Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server","ecosystem":"npm","ecosystems":["npm","maven","nuget","pypi"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["bom","sca","cyclonedx","sbom","docker","oci","containers","owasp","package-url","purl","software-bill-of-materials","saasbom","supply-chain","cbom","spdx","spdx-sbom","inventory","component","dependency","appsec","scrm"],"license_spdx":"Apache-2.0","license_state":"standard","stars":1012,"forks":254,"watchers":11,"monthly_downloads":719229,"latest_score":76,"latest_band":"good","latest_scanned_at":"2026-07-17T12:03:55.171996Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":449,"full_name":"DataDog/dd-trace-php","url":"https://github.com/DataDog/dd-trace-php","description":"Datadog PHP Clients","ecosystem":"crates","ecosystems":["crates","nuget","packagist"],"primary_language":"PHP","languages":[],"topics":["apm","appsec","asm","datadog","open-telemetry","opentracing","php","profiling","tracing"],"license_spdx":null,"license_state":"custom","stars":556,"forks":182,"watchers":114,"monthly_downloads":606988,"latest_score":82,"latest_band":"good","latest_scanned_at":"2026-07-13T15:14:18.157259Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":31101,"full_name":"microsoft/node-api-dotnet","url":"https://github.com/microsoft/node-api-dotnet","description":"Advanced interoperability between .NET and JavaScript in the same process.","ecosystem":"npm","ecosystems":["npm","nuget"],"primary_language":"C#","languages":["C#"],"topics":["node-api","napi","dotnet"],"license_spdx":"MIT","license_state":"standard","stars":778,"forks":79,"watchers":12,"monthly_downloads":55629,"latest_score":58,"latest_band":"moderate","latest_scanned_at":"2026-07-21T05:02:14.584960Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"organic","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":34174,"full_name":"stimulsoft/DataAdapters.JS","url":"https://github.com/stimulsoft/DataAdapters.JS","description":null,"ecosystem":"npm","ecosystems":["npm","maven","nuget"],"primary_language":"PHP","languages":["PHP","Python","C#","JavaScript"],"topics":["aspnet","data-adapter","database","java","javascript","js","net","netcore","nodejs","php","python","mongodb","mssql","mysql","postgres","sql","firebird","odbc","oracle","data"],"license_spdx":null,"license_state":"absent","stars":11,"forks":4,"watchers":5,"monthly_downloads":55036,"latest_score":43,"latest_band":"at_risk","latest_scanned_at":"2026-07-22T05:13:32.459733Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":345,"median":55,"p25":44,"p75":63},{"label":"100 – 999","repositories":147,"median":54,"p25":43,"p75":65},{"label":"1,000 – 9,999","repositories":78,"median":66,"p25":46,"p75":74},{"label":"10,000 and more","repositories":6,"median":78,"p25":65,"p75":80}],"popularity_downloads":[{"label":"Under 10K / month","repositories":17,"median":61,"p25":52,"p75":68},{"label":"10K – 1M","repositories":5,"median":66,"p25":50,"p75":79},{"label":"1M – 100M","repositories":1,"median":62,"p25":62,"p75":62},{"label":"100M and more","repositories":0,"median":null,"p25":null,"p75":null}],"freshness":[{"label":"Pushed within 30 days","repositories":460},{"label":"31 – 90 days","repositories":24},{"label":"91 – 365 days","repositories":30},{"label":"Over a year","repositories":62}],"median_days_since_push":0,"dependencies":{"basis":517,"median_direct":9,"median_indirect":2,"median_total":15,"buckets":[{"label":"0","repositories":10},{"label":"1 – 5","repositories":68},{"label":"6 – 20","repositories":244},{"label":"21 – 50","repositories":100},{"label":"51 – 200","repositories":55},{"label":"201 – 500","repositories":14},{"label":"501 – 1,000","repositories":10},{"label":"Over 1,000","repositories":16}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.0,"measured":574,"inconclusive_share":0.0},{"name":"Fuzzing","mean":0.1,"measured":574,"inconclusive_share":0.0},{"name":"Signed-Releases","mean":0.1,"measured":208,"inconclusive_share":0.6376},{"name":"Pinned-Dependencies","mean":1.0,"measured":442,"inconclusive_share":0.23},{"name":"Branch-Protection","mean":1.3,"measured":414,"inconclusive_share":0.2787},{"name":"Token-Permissions","mean":1.4,"measured":428,"inconclusive_share":0.2544},{"name":"Code-Review","mean":1.9,"measured":563,"inconclusive_share":0.0192},{"name":"SAST","mean":1.9,"measured":574,"inconclusive_share":0.0},{"name":"Security-Policy","mean":2.2,"measured":574,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":4.5,"measured":574,"inconclusive_share":0.0},{"name":"Contributors","mean":5.8,"measured":574,"inconclusive_share":0.0},{"name":"CI-Tests","mean":6.3,"measured":459,"inconclusive_share":0.2003},{"name":"Maintained","mean":6.4,"measured":574,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":9.2,"measured":574,"inconclusive_share":0.0},{"name":"Binary-Artifacts","mean":9.3,"measured":574,"inconclusive_share":0.0},{"name":"License","mean":9.4,"measured":574,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.8,"measured":428,"inconclusive_share":0.2544},{"name":"Packaging","mean":10.0,"measured":214,"inconclusive_share":0.6272}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":23,"repositories":576,"share":0.0399,"share_of_record":0.0399},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":23,"repositories":522,"share":0.0441,"share_of_record":0.0399},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":0,"repositories":172,"share":0.0,"share_of_record":0.0},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":0,"repositories":45,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[17,37,39,31,28,49,65,85,122,103]},{"key":"community","name":"Community & Adoption","bins":[0,13,51,88,118,113,87,58,31,17]},{"key":"governance","name":"Sustainability & Governance","bins":[0,8,8,44,77,164,171,74,30,0]},{"key":"engineering","name":"Engineering Quality","bins":[8,7,61,81,96,104,105,70,39,5]},{"key":"security","name":"Security","bins":[2,10,43,109,121,161,88,36,6,0]},{"key":"ai_readiness","name":"AI Readiness","bins":[3,9,177,99,94,95,64,33,2,0]}],"downloads_top1pct_share":0.9846}