{"ecosystem":"nuget","ecosystem_label":"NuGet","indexed_repositories":2199,"inspected_repositories":2199,"monthly_downloads":5987219,"median_score":60,"share_good_or_better":0.4447,"computed_at":"2026-09-07T11:59:48.044127Z","bands":[{"band":"exceptional","repositories":77,"monthly_downloads":684706},{"band":"excellent","repositories":364,"monthly_downloads":777683},{"band":"good","repositories":537,"monthly_downloads":3995777},{"band":"moderate","repositories":555,"monthly_downloads":463734},{"band":"weak","repositories":361,"monthly_downloads":57644},{"band":"at_risk","repositories":222,"monthly_downloads":2779},{"band":"critical","repositories":83,"monthly_downloads":4896}],"histogram":[{"start":0,"count":2},{"start":5,"count":10},{"start":10,"count":33},{"start":15,"count":38},{"start":20,"count":37},{"start":25,"count":85},{"start":30,"count":100},{"start":35,"count":111},{"start":40,"count":111},{"start":45,"count":139},{"start":50,"count":216},{"start":55,"count":172},{"start":60,"count":167},{"start":65,"count":182},{"start":70,"count":131},{"start":75,"count":224},{"start":80,"count":226},{"start":85,"count":84},{"start":90,"count":93},{"start":95,"count":38}],"categories":[{"key":"vitality","name":"Vitality","median":73,"record_median":71,"repositories":2199},{"key":"community","name":"Community & Adoption","median":49,"record_median":45,"repositories":2199},{"key":"governance","name":"Sustainability & Governance","median":59,"record_median":59,"repositories":2199},{"key":"engineering","name":"Engineering Quality","median":54,"record_median":65,"repositories":2199},{"key":"security","name":"Security","median":52,"record_median":47,"repositories":2199},{"key":"ai_readiness","name":"AI Readiness","median":48,"record_median":53,"repositories":2199}],"practices":[{"key":"readme","label":"README","share":0.9636,"repositories":2199},{"key":"license","label":"License detected","share":0.9509,"repositories":2199},{"key":"ci","label":"CI workflows","share":0.7544,"repositories":2199},{"key":"tests","label":"Automated tests","share":0.5125,"repositories":2199},{"key":"linter","label":"Linter configuration","share":0.0477,"repositories":2199},{"key":"docs_dir","label":"Documentation directory","share":0.337,"repositories":2199},{"key":"contributing","label":"Contributing guide","share":0.3442,"repositories":2199},{"key":"security_policy","label":"Security policy","share":0.1864,"repositories":2199},{"key":"code_of_conduct","label":"Code of conduct","share":0.266,"repositories":2199},{"key":"agent_instructions","label":"AI agent instructions","share":0.2578,"repositories":2199},{"key":"bootstrap","label":"One-command bootstrap","share":0.0337,"repositories":2199},{"key":"llms_txt","label":"llms.txt","share":0.0518,"repositories":2199}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":1142,"median_score":63},{"key":"user","label":"Personal accounts","repositories":1057,"median_score":57}],"bus_factor":[{"bucket":"1","repositories":1842},{"bucket":"2","repositories":224},{"bucket":"3–5","repositories":115},{"bucket":"6+","repositories":14}],"single_maintainer_share":0.8392,"single_maintainer_high_reliance":1,"licenses":[{"license":"MIT","state":"standard","repositories":1410},{"license":"Apache-2.0","state":"standard","repositories":282},{"license":null,"state":"custom","repositories":211},{"license":null,"state":"absent","repositories":108},{"license":"BSD-3-Clause","state":"standard","repositories":59},{"license":"GPL-3.0","state":"standard","repositories":30},{"license":"MPL-2.0","state":"standard","repositories":18},{"license":"LGPL-3.0","state":"standard","repositories":14},{"license":"BSD-2-Clause","state":"standard","repositories":12},{"license":"AGPL-3.0","state":"standard","repositories":11}],"ecosystems":[],"top_repositories":[{"id":30693,"full_name":"pythonnet/clr-loader","url":"https://github.com/pythonnet/clr-loader","description":"Loader for different .NET runtimes","ecosystem":"pypi","ecosystems":["pypi","nuget"],"primary_language":"Python","languages":["Python"],"topics":["clr","dotnet","python","ffi"],"license_spdx":"MIT","license_state":"standard","stars":43,"forks":32,"watchers":4,"monthly_downloads":3058956,"latest_score":77,"latest_band":"good","latest_scanned_at":"2026-08-27T18:58:32.001493Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/pythonnet/clr-loader?v=978c8caf-1","icon_source_type":"avatar","badge_url":""},{"id":23724,"full_name":"renovatebot/pgp","url":"https://github.com/renovatebot/pgp","description":"Renovate PGP library","ecosystem":"npm","ecosystems":["npm","maven","nuget"],"primary_language":"TypeScript","languages":["TypeScript","Java","JavaScript","C#"],"topics":["renovate","pgp"],"license_spdx":"Apache-2.0","license_state":"standard","stars":0,"forks":2,"watchers":0,"monthly_downloads":907231,"latest_score":77,"latest_band":"good","latest_scanned_at":"2026-07-18T23:50:59.130462Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"icon_url":"","icon_source_type":null,"badge_url":""},{"id":15417,"full_name":"cdxgen/cdxgen","url":"https://github.com/cdxgen/cdxgen","description":"Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server","ecosystem":"npm","ecosystems":["npm","maven","nuget","pypi"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["bom","sca","cyclonedx","sbom","docker","oci","containers","owasp","package-url","purl","software-bill-of-materials","saasbom","supply-chain","cbom","spdx","spdx-sbom","inventory","component","dependency","appsec","scrm"],"license_spdx":"Apache-2.0","license_state":"standard","stars":1018,"forks":255,"watchers":11,"monthly_downloads":745344,"latest_score":92,"latest_band":"excellent","latest_scanned_at":"2026-07-28T15:22:20.426282Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"","icon_source_type":null,"badge_url":""},{"id":449,"full_name":"DataDog/dd-trace-php","url":"https://github.com/DataDog/dd-trace-php","description":"Datadog PHP Clients","ecosystem":"packagist","ecosystems":["packagist","crates","nuget"],"primary_language":"PHP","languages":["PHP"],"topics":["datadog","tracing","apm","opentracing","php","appsec","asm","open-telemetry","profiling"],"license_spdx":null,"license_state":"custom","stars":558,"forks":182,"watchers":113,"monthly_downloads":665635,"latest_score":96,"latest_band":"exceptional","latest_scanned_at":"2026-08-22T12:28:40.526537Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/DataDog/dd-trace-php?v=3ae0522c-1","icon_source_type":"readme","badge_url":""},{"id":52322,"full_name":"pywinrt/pywinrt","url":"https://github.com/pywinrt/pywinrt","description":"Python projection of Windows runtime (WinRT) types.","ecosystem":"pypi","ecosystems":["pypi","nuget"],"primary_language":"C++","languages":["C++"],"topics":[],"license_spdx":"MIT","license_state":"standard","stars":196,"forks":14,"watchers":4,"monthly_downloads":362304,"latest_score":59,"latest_band":"moderate","latest_scanned_at":"2026-08-03T03:35:23.609336Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"dormant","red_flags":[],"icon_url":"","icon_source_type":null,"badge_url":""},{"id":31101,"full_name":"microsoft/node-api-dotnet","url":"https://github.com/microsoft/node-api-dotnet","description":"Advanced interoperability between .NET and JavaScript in the same process.","ecosystem":"npm","ecosystems":["npm","nuget"],"primary_language":"C#","languages":["C#"],"topics":["node-api","napi","dotnet"],"license_spdx":"MIT","license_state":"standard","stars":778,"forks":79,"watchers":12,"monthly_downloads":55629,"latest_score":63,"latest_band":"moderate","latest_scanned_at":"2026-07-21T05:02:14.584960Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"organic","abandonment_state":"unverified","red_flags":[],"icon_url":"","icon_source_type":null,"badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":1531,"median":57,"p25":44,"p75":73},{"label":"100 – 999","repositories":441,"median":65,"p25":50,"p75":80},{"label":"1,000 – 9,999","repositories":202,"median":81,"p25":65,"p75":90},{"label":"10,000 and more","repositories":25,"median":94,"p25":82,"p75":98}],"popularity_downloads":[{"label":"Under 10K / month","repositories":32,"median":69,"p25":53,"p75":80},{"label":"10K – 1M","repositories":11,"median":71,"p25":56,"p75":92},{"label":"1M – 100M","repositories":1,"median":77,"p25":77,"p75":77},{"label":"100M and more","repositories":0,"median":null,"p25":null,"p75":null}],"freshness":[{"label":"Pushed within 30 days","repositories":1945},{"label":"31 – 90 days","repositories":60},{"label":"91 – 365 days","repositories":84},{"label":"Over a year","repositories":110}],"median_days_since_push":0,"dependencies":{"basis":2011,"median_direct":8,"median_indirect":3,"median_total":15,"buckets":[{"label":"0","repositories":34},{"label":"1 – 5","repositories":330},{"label":"6 – 20","repositories":875},{"label":"21 – 50","repositories":379},{"label":"51 – 200","repositories":208},{"label":"201 – 500","repositories":78},{"label":"501 – 1,000","repositories":56},{"label":"Over 1,000","repositories":51}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.0,"measured":2193,"inconclusive_share":0.0005},{"name":"Fuzzing","mean":0.1,"measured":2194,"inconclusive_share":0.0},{"name":"Signed-Releases","mean":0.1,"measured":652,"inconclusive_share":0.7028},{"name":"Pinned-Dependencies","mean":1.1,"measured":1685,"inconclusive_share":0.232},{"name":"Branch-Protection","mean":1.4,"measured":1580,"inconclusive_share":0.2799},{"name":"Token-Permissions","mean":1.4,"measured":1649,"inconclusive_share":0.2484},{"name":"Code-Review","mean":1.5,"measured":2168,"inconclusive_share":0.0119},{"name":"SAST","mean":2.2,"measured":2191,"inconclusive_share":0.0014},{"name":"Security-Policy","mean":2.2,"measured":2194,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":4.5,"measured":2194,"inconclusive_share":0.0},{"name":"Contributors","mean":5.5,"measured":2194,"inconclusive_share":0.0},{"name":"CI-Tests","mean":6.3,"measured":1726,"inconclusive_share":0.2133},{"name":"Maintained","mean":6.8,"measured":2194,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":9.1,"measured":2193,"inconclusive_share":0.0005},{"name":"Binary-Artifacts","mean":9.4,"measured":2194,"inconclusive_share":0.0},{"name":"License","mean":9.4,"measured":2194,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.7,"measured":1649,"inconclusive_share":0.2484},{"name":"Packaging","mean":10.0,"measured":970,"inconclusive_share":0.5579}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":83,"repositories":2199,"share":0.0377,"share_of_record":0.0377},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":55,"repositories":2034,"share":0.027,"share_of_record":0.025},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":2,"repositories":1489,"share":0.0013,"share_of_record":0.0009},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":0,"repositories":45,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[36,70,119,134,150,221,277,340,416,436]},{"key":"community","name":"Community & Adoption","bins":[2,27,141,441,536,472,261,169,98,52]},{"key":"governance","name":"Sustainability & Governance","bins":[0,7,19,148,240,729,612,297,121,26]},{"key":"engineering","name":"Engineering Quality","bins":[24,23,237,278,357,361,489,270,136,24]},{"key":"security","name":"Security","bins":[4,18,100,221,511,646,389,277,29,4]},{"key":"ai_readiness","name":"AI Readiness","bins":[4,14,195,402,576,396,323,195,82,12]}],"downloads_top1pct_share":0.9957}