{"ecosystem":"nuget","ecosystem_label":"NuGet","indexed_repositories":4380,"inspected_repositories":4380,"monthly_downloads":6878486,"median_score":65,"share_good_or_better":0.5084,"computed_at":"2026-10-23T09:10:13.816137Z","bands":[{"band":"exceptional","repositories":124,"monthly_downloads":923115},{"band":"excellent","repositories":1061,"monthly_downloads":545039},{"band":"good","repositories":1042,"monthly_downloads":4325951},{"band":"moderate","repositories":1006,"monthly_downloads":771883},{"band":"weak","repositories":642,"monthly_downloads":68729},{"band":"at_risk","repositories":351,"monthly_downloads":494},{"band":"critical","repositories":154,"monthly_downloads":243275}],"histogram":[{"start":0,"count":4},{"start":5,"count":14},{"start":10,"count":58},{"start":15,"count":78},{"start":20,"count":64},{"start":25,"count":123},{"start":30,"count":164},{"start":35,"count":190},{"start":40,"count":180},{"start":45,"count":272},{"start":50,"count":374},{"start":55,"count":332},{"start":60,"count":300},{"start":65,"count":331},{"start":70,"count":244},{"start":75,"count":467},{"start":80,"count":813},{"start":85,"count":155},{"start":90,"count":159},{"start":95,"count":58}],"categories":[{"key":"vitality","name":"Vitality","median":75,"record_median":68,"repositories":4380},{"key":"community","name":"Community & Adoption","median":49,"record_median":44,"repositories":4380},{"key":"governance","name":"Sustainability & Governance","median":57,"record_median":58,"repositories":4380},{"key":"engineering","name":"Engineering Quality","median":60,"record_median":66,"repositories":4380},{"key":"security","name":"Security","median":56,"record_median":49,"repositories":4380},{"key":"ai_readiness","name":"AI Readiness","median":47,"record_median":57,"repositories":4380}],"practices":[{"key":"readme","label":"README","share":0.9671,"repositories":4380},{"key":"license","label":"License detected","share":0.9514,"repositories":4380},{"key":"ci","label":"CI workflows","share":0.7947,"repositories":4380},{"key":"tests","label":"Automated tests","share":0.6005,"repositories":4380},{"key":"linter","label":"Linter configuration","share":0.0393,"repositories":4380},{"key":"docs_dir","label":"Documentation directory","share":0.3201,"repositories":4380},{"key":"contributing","label":"Contributing guide","share":0.4041,"repositories":4380},{"key":"security_policy","label":"Security policy","share":0.284,"repositories":4380},{"key":"code_of_conduct","label":"Code of conduct","share":0.3445,"repositories":4380},{"key":"agent_instructions","label":"AI agent instructions","share":0.2349,"repositories":4380},{"key":"bootstrap","label":"One-command bootstrap","share":0.0297,"repositories":4380},{"key":"llms_txt","label":"llms.txt","share":0.0936,"repositories":4380}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":2038,"median_score":63},{"key":"user","label":"Personal accounts","repositories":2342,"median_score":67}],"bus_factor":[{"bucket":"1","repositories":3792},{"bucket":"2","repositories":394},{"bucket":"3–5","repositories":165},{"bucket":"6+","repositories":21}],"single_maintainer_share":0.8673,"single_maintainer_high_reliance":2,"licenses":[{"license":"MIT","state":"standard","repositories":2978},{"license":"Apache-2.0","state":"standard","repositories":505},{"license":null,"state":"custom","repositories":380},{"license":null,"state":"absent","repositories":213},{"license":"BSD-3-Clause","state":"standard","repositories":78},{"license":"GPL-3.0","state":"standard","repositories":56},{"license":"LGPL-3.0","state":"standard","repositories":32},{"license":"MPL-2.0","state":"standard","repositories":25},{"license":"AGPL-3.0","state":"standard","repositories":20},{"license":"BSD-2-Clause","state":"standard","repositories":18}],"ecosystems":[],"top_repositories":[{"id":30693,"full_name":"pythonnet/clr-loader","url":"https://github.com/pythonnet/clr-loader","description":"Loader for different .NET runtimes","ecosystem":"pypi","ecosystems":["pypi","nuget"],"primary_language":"Python","languages":["Python"],"topics":["clr","dotnet","python","ffi"],"license_spdx":"MIT","license_state":"standard","stars":43,"forks":32,"watchers":4,"monthly_downloads":3058956,"latest_score":77,"latest_band":"good","latest_scanned_at":"2026-08-27T18:58:32.001493Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/pythonnet/clr-loader?v=978c8caf-1","icon_source_type":"avatar","badge_url":""},{"id":23724,"full_name":"renovatebot/pgp","url":"https://github.com/renovatebot/pgp","description":"Renovate PGP library","ecosystem":"npm","ecosystems":["npm","maven","nuget"],"primary_language":"TypeScript","languages":["TypeScript","Java","JavaScript","C#"],"topics":["renovate","pgp"],"license_spdx":"Apache-2.0","license_state":"standard","stars":0,"forks":2,"watchers":0,"monthly_downloads":1044476,"latest_score":78,"latest_band":"good","latest_scanned_at":"2026-09-11T06:08:26.875363Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/renovatebot/pgp?v=fc6030c5-1","icon_source_type":"avatar","badge_url":""},{"id":449,"full_name":"DataDog/dd-trace-php","url":"https://github.com/DataDog/dd-trace-php","description":"Datadog PHP Clients","ecosystem":"packagist","ecosystems":["packagist","crates","nuget"],"primary_language":"PHP","languages":["PHP"],"topics":["datadog","tracing","apm","opentracing","php","appsec","asm","open-telemetry","profiling"],"license_spdx":null,"license_state":"custom","stars":558,"forks":189,"watchers":113,"monthly_downloads":786946,"latest_score":96,"latest_band":"exceptional","latest_scanned_at":"2026-10-20T05:05:06.125190Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/DataDog/dd-trace-php?v=3ae0522c-1","icon_source_type":"readme","badge_url":""},{"id":52322,"full_name":"pywinrt/pywinrt","url":"https://github.com/pywinrt/pywinrt","description":"Python projection of Windows runtime (WinRT) types.","ecosystem":"pypi","ecosystems":["pypi","nuget"],"primary_language":"C++","languages":["C++"],"topics":[],"license_spdx":"MIT","license_state":"standard","stars":198,"forks":15,"watchers":5,"monthly_downloads":362337,"latest_score":63,"latest_band":"moderate","latest_scanned_at":"2026-09-16T01:49:50.053356Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/pywinrt/pywinrt?v=9b650bc3-1","icon_source_type":"avatar","badge_url":""},{"id":94256,"full_name":"extism/extism","url":"https://github.com/extism/extism","description":"The framework for building with WebAssembly (wasm). Easily & securely load wasm modules, move data, call functions, and build extensible apps.","ecosystem":"crates","ecosystems":["crates","nuget","pypi"],"primary_language":"Rust","languages":["Rust"],"topics":["plugin-system","cpp","go","ocaml","python","ruby","rust","haskell","wasm","webassembly","node","elixir","javascript","browser","csharp","dotnet","java","zig","serverless"],"license_spdx":"BSD-3-Clause","license_state":"standard","stars":5793,"forks":168,"watchers":34,"monthly_downloads":323529,"latest_score":80,"latest_band":"excellent","latest_scanned_at":"2026-10-11T21:51:45.853694Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/extism/extism?v=77dc39c3-1","icon_source_type":"homepage","badge_url":""},{"id":33580,"full_name":"dicebear/styles","url":"https://github.com/dicebear/styles","description":"Official DiceBear avatar styles.","ecosystem":"npm","ecosystems":["npm","packagist","pypi","crates","nuget","go"],"primary_language":"Shell","languages":["Shell","C#","Rust"],"topics":["dicebear","avatar","svg"],"license_spdx":null,"license_state":"custom","stars":7,"forks":1,"watchers":2,"monthly_downloads":298188,"latest_score":60,"latest_band":"moderate","latest_scanned_at":"2026-09-12T19:04:13.736018Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"icon_url":"/icon/v1/dicebear/styles?v=b140cf79-1","icon_source_type":"homepage","badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":3252,"median":62,"p25":47,"p75":78},{"label":"100 – 999","repositories":776,"median":67,"p25":53,"p75":80},{"label":"1,000 – 9,999","repositories":322,"median":83,"p25":67,"p75":91},{"label":"10,000 and more","repositories":30,"median":92,"p25":79,"p75":96}],"popularity_downloads":[{"label":"Under 10K / month","repositories":52,"median":67,"p25":57,"p75":81},{"label":"10K – 1M","repositories":18,"median":76,"p25":62,"p75":90},{"label":"1M – 100M","repositories":2,"median":78,"p25":77,"p75":78},{"label":"100M and more","repositories":0,"median":null,"p25":null,"p75":null}],"freshness":[{"label":"Pushed within 30 days","repositories":3529},{"label":"31 – 90 days","repositories":549},{"label":"91 – 365 days","repositories":126},{"label":"Over a year","repositories":176}],"median_days_since_push":1,"dependencies":{"basis":4038,"median_direct":7,"median_indirect":3,"median_total":12,"buckets":[{"label":"0","repositories":71},{"label":"1 – 5","repositories":899},{"label":"6 – 20","repositories":1733},{"label":"21 – 50","repositories":654},{"label":"51 – 200","repositories":369},{"label":"201 – 500","repositories":142},{"label":"501 – 1,000","repositories":93},{"label":"Over 1,000","repositories":77}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.0,"measured":4313,"inconclusive_share":0.0007},{"name":"Fuzzing","mean":0.1,"measured":4313,"inconclusive_share":0.0007},{"name":"Signed-Releases","mean":0.1,"measured":1169,"inconclusive_share":0.7291},{"name":"Pinned-Dependencies","mean":1.0,"measured":3490,"inconclusive_share":0.1914},{"name":"Code-Review","mean":1.3,"measured":4275,"inconclusive_share":0.0095},{"name":"Token-Permissions","mean":1.6,"measured":3418,"inconclusive_share":0.2081},{"name":"Branch-Protection","mean":1.9,"measured":3264,"inconclusive_share":0.2437},{"name":"SAST","mean":2.8,"measured":4291,"inconclusive_share":0.0058},{"name":"Security-Policy","mean":3.1,"measured":4316,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":5.2,"measured":4316,"inconclusive_share":0.0},{"name":"Contributors","mean":5.3,"measured":4316,"inconclusive_share":0.0},{"name":"CI-Tests","mean":7.0,"measured":3459,"inconclusive_share":0.1986},{"name":"Maintained","mean":7.2,"measured":4316,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":9.2,"measured":4315,"inconclusive_share":0.0002},{"name":"License","mean":9.4,"measured":4316,"inconclusive_share":0.0},{"name":"Binary-Artifacts","mean":9.5,"measured":4316,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.8,"measured":3418,"inconclusive_share":0.2081},{"name":"Packaging","mean":10.0,"measured":2242,"inconclusive_share":0.4805}],"red_flags":[{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":174,"repositories":4380,"share":0.0397,"share_of_record":0.0397},{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":89,"repositories":4065,"share":0.0219,"share_of_record":0.0203},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":5,"repositories":3506,"share":0.0014,"share_of_record":0.0011},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":0,"repositories":45,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[59,133,227,241,293,434,479,593,741,1180]},{"key":"community","name":"Community & Adoption","bins":[4,37,240,829,1173,1057,502,301,169,68]},{"key":"governance","name":"Sustainability & Governance","bins":[0,7,18,232,388,1853,1187,488,175,32]},{"key":"engineering","name":"Engineering Quality","bins":[33,43,343,452,656,637,1400,540,241,35]},{"key":"security","name":"Security","bins":[10,22,135,312,854,1188,753,1021,78,7]},{"key":"ai_readiness","name":"AI Readiness","bins":[2,15,110,678,1588,765,588,406,200,28]}],"downloads_top1pct_share":0.9985}