{"ecosystem":"nuget","ecosystem_label":"NuGet","indexed_repositories":4234,"inspected_repositories":4234,"monthly_downloads":6356991,"median_score":65,"share_good_or_better":0.5139,"computed_at":"2026-10-16T10:52:27.643313Z","bands":[{"band":"exceptional","repositories":124,"monthly_downloads":801804},{"band":"excellent","repositories":1043,"monthly_downloads":393769},{"band":"good","repositories":1009,"monthly_downloads":4329263},{"band":"moderate","repositories":958,"monthly_downloads":759986},{"band":"weak","repositories":613,"monthly_downloads":68729},{"band":"at_risk","repositories":334,"monthly_downloads":3273},{"band":"critical","repositories":153,"monthly_downloads":167}],"histogram":[{"start":0,"count":4},{"start":5,"count":13},{"start":10,"count":60},{"start":15,"count":76},{"start":20,"count":62},{"start":25,"count":121},{"start":30,"count":151},{"start":35,"count":184},{"start":40,"count":169},{"start":45,"count":260},{"start":50,"count":356},{"start":55,"count":308},{"start":60,"count":294},{"start":65,"count":316},{"start":70,"count":239},{"start":75,"count":454},{"start":80,"count":807},{"start":85,"count":150},{"start":90,"count":153},{"start":95,"count":57}],"categories":[{"key":"vitality","name":"Vitality","median":76,"record_median":68,"repositories":4234},{"key":"community","name":"Community & Adoption","median":49,"record_median":45,"repositories":4234},{"key":"governance","name":"Sustainability & Governance","median":57,"record_median":58,"repositories":4234},{"key":"engineering","name":"Engineering Quality","median":60,"record_median":66,"repositories":4234},{"key":"security","name":"Security","median":56,"record_median":49,"repositories":4234},{"key":"ai_readiness","name":"AI Readiness","median":47,"record_median":56,"repositories":4234}],"practices":[{"key":"readme","label":"README","share":0.9669,"repositories":4234},{"key":"license","label":"License detected","share":0.9521,"repositories":4234},{"key":"ci","label":"CI workflows","share":0.7976,"repositories":4234},{"key":"tests","label":"Automated tests","share":0.6004,"repositories":4234},{"key":"linter","label":"Linter configuration","share":0.0394,"repositories":4234},{"key":"docs_dir","label":"Documentation directory","share":0.3153,"repositories":4234},{"key":"contributing","label":"Contributing guide","share":0.411,"repositories":4234},{"key":"security_policy","label":"Security policy","share":0.2884,"repositories":4234},{"key":"code_of_conduct","label":"Code of conduct","share":0.3486,"repositories":4234},{"key":"agent_instructions","label":"AI agent instructions","share":0.2303,"repositories":4234},{"key":"bootstrap","label":"One-command bootstrap","share":0.0298,"repositories":4234},{"key":"llms_txt","label":"llms.txt","share":0.0893,"repositories":4234}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":1961,"median_score":63},{"key":"user","label":"Personal accounts","repositories":2273,"median_score":67}],"bus_factor":[{"bucket":"1","repositories":3663},{"bucket":"2","repositories":380},{"bucket":"3–5","repositories":162},{"bucket":"6+","repositories":21}],"single_maintainer_share":0.8668,"single_maintainer_high_reliance":2,"licenses":[{"license":"MIT","state":"standard","repositories":2886},{"license":"Apache-2.0","state":"standard","repositories":494},{"license":null,"state":"custom","repositories":355},{"license":null,"state":"absent","repositories":203},{"license":"BSD-3-Clause","state":"standard","repositories":77},{"license":"GPL-3.0","state":"standard","repositories":54},{"license":"LGPL-3.0","state":"standard","repositories":31},{"license":"MPL-2.0","state":"standard","repositories":26},{"license":"AGPL-3.0","state":"standard","repositories":18},{"license":"BSD-2-Clause","state":"standard","repositories":17}],"ecosystems":[],"top_repositories":[{"id":30693,"full_name":"pythonnet/clr-loader","url":"https://github.com/pythonnet/clr-loader","description":"Loader for different .NET runtimes","ecosystem":"pypi","ecosystems":["pypi","nuget"],"primary_language":"Python","languages":["Python"],"topics":["clr","dotnet","python","ffi"],"license_spdx":"MIT","license_state":"standard","stars":43,"forks":32,"watchers":4,"monthly_downloads":3058956,"latest_score":77,"latest_band":"good","latest_scanned_at":"2026-08-27T18:58:32.001493Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/pythonnet/clr-loader?v=978c8caf-1","icon_source_type":"avatar","badge_url":""},{"id":23724,"full_name":"renovatebot/pgp","url":"https://github.com/renovatebot/pgp","description":"Renovate PGP library","ecosystem":"npm","ecosystems":["npm","maven","nuget"],"primary_language":"TypeScript","languages":["TypeScript","Java","JavaScript","C#"],"topics":["renovate","pgp"],"license_spdx":"Apache-2.0","license_state":"standard","stars":0,"forks":2,"watchers":0,"monthly_downloads":1044476,"latest_score":78,"latest_band":"good","latest_scanned_at":"2026-09-11T06:08:26.875363Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/renovatebot/pgp?v=fc6030c5-1","icon_source_type":"avatar","badge_url":""},{"id":449,"full_name":"DataDog/dd-trace-php","url":"https://github.com/DataDog/dd-trace-php","description":"Datadog PHP Clients","ecosystem":"packagist","ecosystems":["packagist","crates","nuget"],"primary_language":"PHP","languages":["PHP"],"topics":["datadog","tracing","apm","opentracing","php","appsec","asm","open-telemetry","profiling"],"license_spdx":null,"license_state":"custom","stars":558,"forks":182,"watchers":113,"monthly_downloads":665635,"latest_score":96,"latest_band":"exceptional","latest_scanned_at":"2026-08-22T12:28:40.526537Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/DataDog/dd-trace-php?v=3ae0522c-1","icon_source_type":"readme","badge_url":""},{"id":52322,"full_name":"pywinrt/pywinrt","url":"https://github.com/pywinrt/pywinrt","description":"Python projection of Windows runtime (WinRT) types.","ecosystem":"pypi","ecosystems":["pypi","nuget"],"primary_language":"C++","languages":["C++"],"topics":[],"license_spdx":"MIT","license_state":"standard","stars":198,"forks":15,"watchers":5,"monthly_downloads":362337,"latest_score":63,"latest_band":"moderate","latest_scanned_at":"2026-09-16T01:49:50.053356Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/pywinrt/pywinrt?v=9b650bc3-1","icon_source_type":"avatar","badge_url":""},{"id":94256,"full_name":"extism/extism","url":"https://github.com/extism/extism","description":"The framework for building with WebAssembly (wasm). Easily & securely load wasm modules, move data, call functions, and build extensible apps.","ecosystem":"crates","ecosystems":["crates","nuget","pypi"],"primary_language":"Rust","languages":["Rust"],"topics":["plugin-system","cpp","go","ocaml","python","ruby","rust","haskell","wasm","webassembly","node","elixir","javascript","browser","csharp","dotnet","java","zig","serverless"],"license_spdx":"BSD-3-Clause","license_state":"standard","stars":5793,"forks":168,"watchers":34,"monthly_downloads":323529,"latest_score":80,"latest_band":"excellent","latest_scanned_at":"2026-10-11T21:51:45.853694Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/extism/extism?v=77dc39c3-1","icon_source_type":"homepage","badge_url":""},{"id":33580,"full_name":"dicebear/styles","url":"https://github.com/dicebear/styles","description":"Official DiceBear avatar styles.","ecosystem":"npm","ecosystems":["npm","packagist","pypi","crates","nuget","go"],"primary_language":"Shell","languages":["Shell","C#","Rust"],"topics":["dicebear","avatar","svg"],"license_spdx":null,"license_state":"custom","stars":7,"forks":1,"watchers":2,"monthly_downloads":298188,"latest_score":60,"latest_band":"moderate","latest_scanned_at":"2026-09-12T19:04:13.736018Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/dicebear/styles?v=b140cf79-1","icon_source_type":"homepage","badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":3137,"median":62,"p25":47,"p75":78},{"label":"100 – 999","repositories":749,"median":67,"p25":53,"p75":81},{"label":"1,000 – 9,999","repositories":318,"median":81,"p25":67,"p75":91},{"label":"10,000 and more","repositories":30,"median":92,"p25":79,"p75":96}],"popularity_downloads":[{"label":"Under 10K / month","repositories":50,"median":69,"p25":52,"p75":81},{"label":"10K – 1M","repositories":14,"median":74,"p25":62,"p75":89},{"label":"1M – 100M","repositories":2,"median":78,"p25":77,"p75":78},{"label":"100M and more","repositories":0,"median":null,"p25":null,"p75":null}],"freshness":[{"label":"Pushed within 30 days","repositories":3491},{"label":"31 – 90 days","repositories":439},{"label":"91 – 365 days","repositories":127},{"label":"Over a year","repositories":177}],"median_days_since_push":0,"dependencies":{"basis":3906,"median_direct":7,"median_indirect":3,"median_total":12,"buckets":[{"label":"0","repositories":69},{"label":"1 – 5","repositories":885},{"label":"6 – 20","repositories":1661},{"label":"21 – 50","repositories":627},{"label":"51 – 200","repositories":366},{"label":"201 – 500","repositories":137},{"label":"501 – 1,000","repositories":90},{"label":"Over 1,000","repositories":71}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.0,"measured":4175,"inconclusive_share":0.0007},{"name":"Fuzzing","mean":0.1,"measured":4175,"inconclusive_share":0.0007},{"name":"Signed-Releases","mean":0.1,"measured":1135,"inconclusive_share":0.7283},{"name":"Pinned-Dependencies","mean":1.0,"measured":3381,"inconclusive_share":0.1908},{"name":"Code-Review","mean":1.3,"measured":4136,"inconclusive_share":0.0101},{"name":"Token-Permissions","mean":1.5,"measured":3320,"inconclusive_share":0.2054},{"name":"Branch-Protection","mean":1.9,"measured":3152,"inconclusive_share":0.2456},{"name":"SAST","mean":2.8,"measured":4154,"inconclusive_share":0.0057},{"name":"Security-Policy","mean":3.1,"measured":4178,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":5.2,"measured":4178,"inconclusive_share":0.0},{"name":"Contributors","mean":5.3,"measured":4178,"inconclusive_share":0.0},{"name":"CI-Tests","mean":7.0,"measured":3376,"inconclusive_share":0.192},{"name":"Maintained","mean":7.2,"measured":4178,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":9.2,"measured":4177,"inconclusive_share":0.0002},{"name":"License","mean":9.4,"measured":4178,"inconclusive_share":0.0},{"name":"Binary-Artifacts","mean":9.5,"measured":4178,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.8,"measured":3320,"inconclusive_share":0.2054},{"name":"Packaging","mean":10.0,"measured":2172,"inconclusive_share":0.4801}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":175,"repositories":4234,"share":0.0413,"share_of_record":0.0413},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":88,"repositories":3935,"share":0.0224,"share_of_record":0.0208},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":4,"repositories":3389,"share":0.0012,"share_of_record":0.0009},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":0,"repositories":45,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[59,127,220,220,284,380,472,585,726,1161]},{"key":"community","name":"Community & Adoption","bins":[4,35,233,787,1137,1021,487,296,168,66]},{"key":"governance","name":"Sustainability & Governance","bins":[0,7,19,235,369,1783,1145,469,177,30]},{"key":"engineering","name":"Engineering Quality","bins":[32,40,332,437,622,623,1374,514,229,31]},{"key":"security","name":"Security","bins":[10,22,125,306,815,1147,719,1008,74,8]},{"key":"ai_readiness","name":"AI Readiness","bins":[1,14,111,665,1544,741,575,373,183,27]}],"downloads_top1pct_share":0.999}