{"ecosystem":"packagist","ecosystem_label":"Packagist","indexed_repositories":3324,"inspected_repositories":3324,"monthly_downloads":3935902198,"median_score":58,"share_good_or_better":0.1613,"computed_at":"2026-07-24T01:25:06.717048Z","bands":[{"band":"excellent","repositories":15,"monthly_downloads":97885087},{"band":"good","repositories":521,"monthly_downloads":1218892458},{"band":"moderate","repositories":1853,"monthly_downloads":1642637664},{"band":"at_risk","repositories":801,"monthly_downloads":823122568},{"band":"critical","repositories":134,"monthly_downloads":153364421}],"histogram":[{"start":0,"count":0},{"start":5,"count":2},{"start":10,"count":3},{"start":15,"count":7},{"start":20,"count":46},{"start":25,"count":76},{"start":30,"count":162},{"start":35,"count":124},{"start":40,"count":197},{"start":45,"count":318},{"start":50,"count":393},{"start":55,"count":492},{"start":60,"count":543},{"start":65,"count":425},{"start":70,"count":291},{"start":75,"count":157},{"start":80,"count":73},{"start":85,"count":15},{"start":90,"count":0},{"start":95,"count":0}],"categories":[{"key":"vitality","name":"Vitality","median":68,"record_median":73,"repositories":3324},{"key":"community","name":"Community & Adoption","median":51,"record_median":46,"repositories":3324},{"key":"governance","name":"Sustainability & Governance","median":64,"record_median":59,"repositories":3324},{"key":"engineering","name":"Engineering Quality","median":63,"record_median":66,"repositories":3324},{"key":"security","name":"Security","median":45,"record_median":45,"repositories":3324},{"key":"ai_readiness","name":"AI Readiness","median":32,"record_median":46,"repositories":3324}],"practices":[{"key":"readme","label":"README","share":0.9594,"repositories":3324},{"key":"license","label":"License detected","share":0.9209,"repositories":3324},{"key":"ci","label":"CI workflows","share":0.7948,"repositories":3324},{"key":"tests","label":"Automated tests","share":0.8381,"repositories":3324},{"key":"linter","label":"Linter configuration","share":0.4708,"repositories":3324},{"key":"docs_dir","label":"Documentation directory","share":0.2674,"repositories":3324},{"key":"contributing","label":"Contributing guide","share":0.4913,"repositories":3324},{"key":"security_policy","label":"Security policy","share":0.2292,"repositories":3324},{"key":"code_of_conduct","label":"Code of conduct","share":0.2768,"repositories":3324},{"key":"agent_instructions","label":"AI agent instructions","share":0.1203,"repositories":3324},{"key":"bootstrap","label":"One-command bootstrap","share":0.133,"repositories":3324},{"key":"llms_txt","label":"llms.txt","share":0.0054,"repositories":3324}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":2615,"median_score":58},{"key":"user","label":"Personal accounts","repositories":709,"median_score":57}],"bus_factor":[{"bucket":"1","repositories":1986},{"bucket":"2","repositories":879},{"bucket":"3–5","repositories":399},{"bucket":"6+","repositories":57}],"single_maintainer_share":0.598,"single_maintainer_high_reliance":287,"licenses":[{"license":"MIT","state":"standard","repositories":1830},{"license":null,"state":"custom","repositories":399},{"license":"BSD-3-Clause","state":"standard","repositories":271},{"license":null,"state":"absent","repositories":263},{"license":"GPL-2.0","state":"standard","repositories":167},{"license":"Apache-2.0","state":"standard","repositories":134},{"license":"GPL-3.0","state":"standard","repositories":105},{"license":"LGPL-3.0","state":"standard","repositories":33},{"license":"AGPL-3.0","state":"standard","repositories":25},{"license":"LGPL-2.1","state":"standard","repositories":22}],"ecosystems":[],"top_repositories":[{"id":36259,"full_name":"handlebars-lang/handlebars.js","url":"https://github.com/handlebars-lang/handlebars.js","description":"Minimal templating on steroids.","ecosystem":"npm","ecosystems":["npm","rubygems","packagist"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["handlebars","mustache","templates","template","html"],"license_spdx":"MIT","license_state":"standard","stars":18656,"forks":2066,"watchers":433,"monthly_downloads":165639348,"latest_score":74,"latest_band":"good","latest_scanned_at":"2026-07-22T22:39:13.337941Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"maintained","red_flags":[],"badge_url":""},{"id":260,"full_name":"moment/moment","url":"https://github.com/moment/moment","description":"Parse, validate, manipulate, and display dates in javascript.","ecosystem":"npm","ecosystems":["npm","packagist"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["moment","date","time","parse","format","validate","i18n","l10n","ender"],"license_spdx":"MIT","license_state":"standard","stars":47936,"forks":6993,"watchers":826,"monthly_downloads":137790144,"latest_score":32,"latest_band":"at_risk","latest_scanned_at":"2026-07-21T21:43:43.798150Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"organic","abandonment_state":"likely_abandoned","red_flags":[],"badge_url":""},{"id":4837,"full_name":"google/flatbuffers","url":"https://github.com/google/flatbuffers","description":"FlatBuffers: Memory Efficient Serialization Library","ecosystem":"pypi","ecosystems":["pypi","npm","packagist","go","maven"],"primary_language":"C++","languages":["C++","Rust"],"topics":["flatbuffers","serialization","serialization-library","json-parser","marshalling","rpc","zero-copy","mmap","cross-platform","c-plus-plus","java","c-sharp","go","python","rust","javascript","typescript","grpc","protobuf","google"],"license_spdx":"Apache-2.0","license_state":"standard","stars":26240,"forks":3606,"watchers":629,"monthly_downloads":119765899,"latest_score":40,"latest_band":"at_risk","latest_scanned_at":"2026-07-20T17:02:44.024503Z","has_high_risk_jurisdiction_exposure":true,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":["high_risk_jurisdiction_exposure"],"badge_url":""},{"id":79,"full_name":"chartjs/Chart.js","url":"https://github.com/chartjs/Chart.js","description":"Simple HTML5 Charts using the <canvas> tag","ecosystem":"npm","ecosystems":["npm","packagist"],"primary_language":"JavaScript","languages":[],"topics":["canvas","chart","graph","html5","html5-charts","javascript"],"license_spdx":"MIT","license_state":"standard","stars":67569,"forks":11950,"watchers":1342,"monthly_downloads":53553265,"latest_score":71,"latest_band":"good","latest_scanned_at":"2026-07-13T01:34:13.836748Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":15887,"full_name":"swagger-api/swagger-ui","url":"https://github.com/swagger-api/swagger-ui","description":"Swagger UI is a collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API.","ecosystem":"npm","ecosystems":["npm","packagist"],"primary_language":"JavaScript","languages":["JavaScript"],"topics":["swagger","swagger-ui","swagger-api","swagger-js","rest","rest-api","openapi-specification","oas","openapi","openapi3","hacktoberfest","openapi31","open-source","swagger-oss","documentation","ui","api","specification"],"license_spdx":"Apache-2.0","license_state":"standard","stars":28917,"forks":9263,"watchers":620,"monthly_downloads":47388955,"latest_score":87,"latest_band":"excellent","latest_scanned_at":"2026-07-22T06:30:10.552449Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"organic","abandonment_state":"maintained","red_flags":[],"badge_url":""},{"id":443,"full_name":"yiisoft/yii2-framework","url":"https://github.com/yiisoft/yii2-framework","description":"[READ ONLY] Yii 2 framework core code only. This is a subtree split off the \"yii2\" repository","ecosystem":"npm","ecosystems":["npm","packagist"],"primary_language":"PHP","languages":[],"topics":["php","yii","yii-framework"],"license_spdx":"BSD-3-Clause","license_state":"standard","stars":234,"forks":130,"watchers":45,"monthly_downloads":41946696,"latest_score":58,"latest_band":"moderate","latest_scanned_at":"2026-07-13T15:09:36.315025Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":2147,"median":55,"p25":47,"p75":62},{"label":"100 – 999","repositories":712,"median":63,"p25":54,"p75":69},{"label":"1,000 – 9,999","repositories":400,"median":69,"p25":59,"p75":76},{"label":"10,000 and more","repositories":65,"median":74,"p25":65,"p75":81}],"popularity_downloads":[{"label":"Under 10K / month","repositories":1308,"median":54,"p25":48,"p75":61},{"label":"10K – 1M","repositories":1458,"median":60,"p25":50,"p75":68},{"label":"1M – 100M","repositories":484,"median":65,"p25":52,"p75":72},{"label":"100M and more","repositories":3,"median":40,"p25":32,"p75":74}],"freshness":[{"label":"Pushed within 30 days","repositories":2852},{"label":"31 – 90 days","repositories":138},{"label":"91 – 365 days","repositories":263},{"label":"Over a year","repositories":71}],"median_days_since_push":0,"dependencies":{"basis":2651,"median_direct":2,"median_indirect":9,"median_total":13,"buckets":[{"label":"0","repositories":38},{"label":"1 – 5","repositories":539},{"label":"6 – 20","repositories":1129},{"label":"21 – 50","repositories":302},{"label":"51 – 200","repositories":367},{"label":"201 – 500","repositories":117},{"label":"501 – 1,000","repositories":82},{"label":"Over 1,000","repositories":77}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.0,"measured":3294,"inconclusive_share":0.003},{"name":"Fuzzing","mean":0.0,"measured":3303,"inconclusive_share":0.0003},{"name":"SAST","mean":0.7,"measured":3303,"inconclusive_share":0.0003},{"name":"Branch-Protection","mean":1.0,"measured":2189,"inconclusive_share":0.3375},{"name":"Pinned-Dependencies","mean":1.2,"measured":998,"inconclusive_share":0.6979},{"name":"Signed-Releases","mean":1.4,"measured":202,"inconclusive_share":0.9389},{"name":"Token-Permissions","mean":1.5,"measured":945,"inconclusive_share":0.714},{"name":"Code-Review","mean":2.3,"measured":3285,"inconclusive_share":0.0058},{"name":"Security-Policy","mean":2.9,"measured":3304,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":4.3,"measured":3304,"inconclusive_share":0.0},{"name":"Maintained","mean":5.3,"measured":3304,"inconclusive_share":0.0},{"name":"CI-Tests","mean":5.9,"measured":2423,"inconclusive_share":0.2666},{"name":"Contributors","mean":7.9,"measured":3304,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":8.9,"measured":3304,"inconclusive_share":0.0},{"name":"License","mean":9.1,"measured":3304,"inconclusive_share":0.0},{"name":"Dangerous-Workflow","mean":9.8,"measured":945,"inconclusive_share":0.714},{"name":"Binary-Artifacts","mean":10.0,"measured":3304,"inconclusive_share":0.0},{"name":"Packaging","mean":10.0,"measured":77,"inconclusive_share":0.9767}],"red_flags":[{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":274,"repositories":3274,"share":0.0837,"share_of_record":0.0824},{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":58,"repositories":3324,"share":0.0174,"share_of_record":0.0174},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":0,"repositories":377,"share":0.0,"share_of_record":0.0},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":0,"repositories":166,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[2,43,115,232,238,498,597,627,567,405]},{"key":"community","name":"Community & Adoption","bins":[2,19,186,569,753,648,501,311,252,83]},{"key":"governance","name":"Sustainability & Governance","bins":[0,1,6,73,206,806,1296,714,221,1]},{"key":"engineering","name":"Engineering Quality","bins":[7,80,165,260,357,459,782,699,408,107]},{"key":"security","name":"Security","bins":[10,47,354,698,1003,693,379,122,18,0]},{"key":"ai_readiness","name":"AI Readiness","bins":[46,355,878,1184,344,299,134,68,16,0]}],"downloads_top1pct_share":0.2779}