{"ecosystem":"pypi","ecosystem_label":"PyPI","indexed_repositories":5327,"inspected_repositories":5326,"monthly_downloads":51628884089,"median_score":62,"share_good_or_better":0.3224,"computed_at":"2026-07-23T20:51:07.287504Z","bands":[{"band":"excellent","repositories":215,"monthly_downloads":14005151353},{"band":"good","repositories":1502,"monthly_downloads":19443110471},{"band":"moderate","repositories":2451,"monthly_downloads":12033358591},{"band":"at_risk","repositories":923,"monthly_downloads":4882272184},{"band":"critical","repositories":235,"monthly_downloads":1264991490}],"histogram":[{"start":0,"count":0},{"start":5,"count":7},{"start":10,"count":23},{"start":15,"count":44},{"start":20,"count":73},{"start":25,"count":88},{"start":30,"count":159},{"start":35,"count":178},{"start":40,"count":247},{"start":45,"count":339},{"start":50,"count":496},{"start":55,"count":639},{"start":60,"count":652},{"start":65,"count":664},{"start":70,"count":654},{"start":75,"count":517},{"start":80,"count":331},{"start":85,"count":185},{"start":90,"count":27},{"start":95,"count":3}],"categories":[{"key":"vitality","name":"Vitality","median":75,"record_median":73,"repositories":5326},{"key":"community","name":"Community & Adoption","median":58,"record_median":46,"repositories":5326},{"key":"governance","name":"Sustainability & Governance","median":62,"record_median":59,"repositories":5326},{"key":"engineering","name":"Engineering Quality","median":75,"record_median":66,"repositories":5326},{"key":"security","name":"Security","median":48,"record_median":45,"repositories":5326},{"key":"ai_readiness","name":"AI Readiness","median":47,"record_median":46,"repositories":5326}],"practices":[{"key":"readme","label":"README","share":0.9707,"repositories":5326},{"key":"license","label":"License detected","share":0.9619,"repositories":5326},{"key":"ci","label":"CI workflows","share":0.8967,"repositories":5326},{"key":"tests","label":"Automated tests","share":0.9382,"repositories":5326},{"key":"linter","label":"Linter configuration","share":0.571,"repositories":5326},{"key":"docs_dir","label":"Documentation directory","share":0.6694,"repositories":5326},{"key":"contributing","label":"Contributing guide","share":0.4769,"repositories":5326},{"key":"security_policy","label":"Security policy","share":0.2338,"repositories":5326},{"key":"code_of_conduct","label":"Code of conduct","share":0.2713,"repositories":5326},{"key":"agent_instructions","label":"AI agent instructions","share":0.2754,"repositories":5326},{"key":"bootstrap","label":"One-command bootstrap","share":0.5073,"repositories":5326},{"key":"llms_txt","label":"llms.txt","share":0.0253,"repositories":5326}],"stewardship":[{"key":"organization","label":"Organization-stewarded","repositories":3315,"median_score":67},{"key":"user","label":"Personal accounts","repositories":2011,"median_score":56}],"bus_factor":[{"bucket":"1","repositories":3604},{"bucket":"2","repositories":949},{"bucket":"3–5","repositories":592},{"bucket":"6+","repositories":165}],"single_maintainer_share":0.6787,"single_maintainer_high_reliance":507,"licenses":[{"license":"MIT","state":"standard","repositories":2110},{"license":"Apache-2.0","state":"standard","repositories":1234},{"license":null,"state":"custom","repositories":765},{"license":"BSD-3-Clause","state":"standard","repositories":387},{"license":null,"state":"absent","repositories":203},{"license":"GPL-3.0","state":"standard","repositories":181},{"license":"AGPL-3.0","state":"standard","repositories":130},{"license":"BSD-2-Clause","state":"standard","repositories":89},{"license":"MPL-2.0","state":"standard","repositories":52},{"license":"LGPL-3.0","state":"standard","repositories":47}],"ecosystems":[],"top_repositories":[{"id":10000,"full_name":"pypa/packaging","url":"https://github.com/pypa/packaging","description":"Core utilities for Python packages","ecosystem":"pypi","ecosystems":["pypi"],"primary_language":"Python","languages":["Python"],"topics":[],"license_spdx":null,"license_state":"custom","stars":745,"forks":311,"watchers":26,"monthly_downloads":2071271712,"latest_score":89,"latest_band":"excellent","latest_scanned_at":"2026-07-16T12:12:52.923800Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":9998,"full_name":"psf/requests","url":"https://github.com/psf/requests","description":"A simple, yet elegant, HTTP library.","ecosystem":"pypi","ecosystems":["pypi"],"primary_language":"Python","languages":["Python"],"topics":["python","http","forhumans","requests","python-requests","client","humans","cookies"],"license_spdx":"Apache-2.0","license_state":"standard","stars":54145,"forks":10014,"watchers":1297,"monthly_downloads":1651615794,"latest_score":89,"latest_band":"excellent","latest_scanned_at":"2026-07-16T12:12:30.133445Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":10009,"full_name":"kjd/idna","url":"https://github.com/kjd/idna","description":"Internationalized Domain Names for Python (IDNA 2008 and UTS #46)","ecosystem":"pypi","ecosystems":["pypi"],"primary_language":"Python","languages":["Python"],"topics":["python","idna","dns","unicode"],"license_spdx":"BSD-3-Clause","license_state":"standard","stars":287,"forks":126,"watchers":11,"monthly_downloads":1644816701,"latest_score":71,"latest_band":"good","latest_scanned_at":"2026-07-16T12:14:52.268624Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":10019,"full_name":"pyca/cryptography","url":"https://github.com/pyca/cryptography/","description":"cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.","ecosystem":"pypi","ecosystems":["pypi","crates"],"primary_language":"Python","languages":["Python","Rust"],"topics":["python","cryptography"],"license_spdx":null,"license_state":"custom","stars":7664,"forks":1787,"watchers":127,"monthly_downloads":1379176440,"latest_score":84,"latest_band":"good","latest_scanned_at":"2026-07-16T12:17:22.152269Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":17676,"full_name":"aio-libs/aiobotocore","url":"https://github.com/aio-libs/aiobotocore","description":"asyncio support for botocore library using aiohttp","ecosystem":"pypi","ecosystems":["pypi"],"primary_language":"Python","languages":["Python"],"topics":["asyncio","aiohttp","botocore","aws","aws-sdk","cloud-management","cloud"],"license_spdx":"Apache-2.0","license_state":"standard","stars":1418,"forks":205,"watchers":20,"monthly_downloads":1181542416,"latest_score":88,"latest_band":"excellent","latest_scanned_at":"2026-07-17T16:25:44.835443Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"unverified","abandonment_state":"unverified","red_flags":[],"badge_url":""},{"id":10005,"full_name":"numpy/numpy","url":"https://github.com/numpy/numpy","description":"The fundamental package for scientific computing with Python.","ecosystem":"pypi","ecosystems":["pypi"],"primary_language":"Python","languages":["Python","C"],"topics":["numpy","python"],"license_spdx":null,"license_state":"custom","stars":32406,"forks":12583,"watchers":601,"monthly_downloads":1087308298,"latest_score":91,"latest_band":"excellent","latest_scanned_at":"2026-07-22T01:55:00.535386Z","has_high_risk_jurisdiction_exposure":false,"has_malicious_dependency":false,"growth_authenticity":"organic","abandonment_state":"maintained","red_flags":[],"badge_url":""}],"popularity_stars":[{"label":"Under 100 stars","repositories":2515,"median":57,"p25":48,"p75":64},{"label":"100 – 999","repositories":1476,"median":65,"p25":53,"p75":73},{"label":"1,000 – 9,999","repositories":961,"median":72,"p25":62,"p75":79},{"label":"10,000 and more","repositories":374,"median":80,"p25":74,"p75":86}],"popularity_downloads":[{"label":"Under 10K / month","repositories":1221,"median":59,"p25":51,"p75":67},{"label":"10K – 1M","repositories":670,"median":66,"p25":58,"p75":73},{"label":"1M – 100M","repositories":798,"median":67,"p25":53,"p75":77},{"label":"100M and more","repositories":93,"median":78,"p25":62,"p75":84}],"freshness":[{"label":"Pushed within 30 days","repositories":4069},{"label":"31 – 90 days","repositories":283},{"label":"91 – 365 days","repositories":452},{"label":"Over a year","repositories":522}],"median_days_since_push":2,"dependencies":{"basis":4086,"median_direct":2,"median_indirect":18,"median_total":23,"buckets":[{"label":"0","repositories":345},{"label":"1 – 5","repositories":745},{"label":"6 – 20","repositories":891},{"label":"21 – 50","repositories":540},{"label":"51 – 200","repositories":732},{"label":"201 – 500","repositories":359},{"label":"501 – 1,000","repositories":201},{"label":"Over 1,000","repositories":273}]},"scorecard_checks":[{"name":"CII-Best-Practices","mean":0.1,"measured":5141,"inconclusive_share":0.0043},{"name":"Fuzzing","mean":0.7,"measured":5163,"inconclusive_share":0.0},{"name":"Signed-Releases","mean":1.1,"measured":1653,"inconclusive_share":0.6798},{"name":"Branch-Protection","mean":1.5,"measured":3473,"inconclusive_share":0.3273},{"name":"Pinned-Dependencies","mean":1.6,"measured":4700,"inconclusive_share":0.0897},{"name":"SAST","mean":1.8,"measured":5158,"inconclusive_share":0.001},{"name":"Token-Permissions","mean":1.9,"measured":4564,"inconclusive_share":0.116},{"name":"Code-Review","mean":2.7,"measured":5143,"inconclusive_share":0.0039},{"name":"Security-Policy","mean":3.0,"measured":5163,"inconclusive_share":0.0},{"name":"Dependency-Update-Tool","mean":4.7,"measured":5163,"inconclusive_share":0.0},{"name":"Maintained","mean":6.0,"measured":5163,"inconclusive_share":0.0},{"name":"Vulnerabilities","mean":6.5,"measured":5160,"inconclusive_share":0.0006},{"name":"CI-Tests","mean":6.8,"measured":4283,"inconclusive_share":0.1704},{"name":"Contributors","mean":7.1,"measured":5163,"inconclusive_share":0.0},{"name":"License","mean":9.5,"measured":5163,"inconclusive_share":0.0},{"name":"Binary-Artifacts","mean":9.7,"measured":5162,"inconclusive_share":0.0002},{"name":"Dangerous-Workflow","mean":9.7,"measured":4564,"inconclusive_share":0.116},{"name":"Packaging","mean":10.0,"measured":2419,"inconclusive_share":0.5315}],"red_flags":[{"key":"high_risk_jurisdiction_exposure","label":"High-Risk Jurisdiction Exposure","wiki_slug":"jurisdiction-exposure","findings":180,"repositories":4876,"share":0.0369,"share_of_record":0.0338},{"key":"abandonment","label":"Abandonment","wiki_slug":"abandonment","findings":141,"repositories":5326,"share":0.0265,"share_of_record":0.0265},{"key":"inorganic_growth","label":"Inorganic growth","wiki_slug":"growth-authenticity","findings":1,"repositories":516,"share":0.0019,"share_of_record":0.0002},{"key":"malicious_dependencies","label":"Malicious dependencies","wiki_slug":"malicious-dependencies","findings":0,"repositories":1201,"share":0.0,"share_of_record":0.0}],"category_histograms":[{"key":"vitality","name":"Vitality","bins":[60,317,336,304,317,328,479,926,1012,1247]},{"key":"community","name":"Community & Adoption","bins":[7,140,374,660,775,820,883,788,536,343]},{"key":"governance","name":"Sustainability & Governance","bins":[0,15,56,299,456,1325,1636,1035,481,23]},{"key":"engineering","name":"Engineering Quality","bins":[2,14,74,189,272,523,914,1235,1201,902]},{"key":"security","name":"Security","bins":[69,74,366,996,1283,1272,734,412,99,21]},{"key":"ai_readiness","name":"AI Readiness","bins":[5,148,594,1031,1223,917,526,491,348,43]}],"downloads_top1pct_share":0.6475}