Health-index distribution
Latest health index of every inspected repository, in five-point intervals over the 1–100 scale.
median 59
Critical · 4706At Risk · 12174Weak · 14841Moderate · 22635Good · 18711157924418
Record in aggregate · metrics 2.10.0
The state of the record.
Aggregate statistics across the public record — how software health distributes, where the download volume concentrates, and which engineering practices are common or rare. Figures describe the inspected record, not the entirety of open source.
Inspected repositories
93,277 of 96,493 indexed
Repositories with a published inspection report — the basis of every figure on this page. Indexed repositories without a first report are excluded.
Monthly downloads under inspection
646B registry-reported
Combined monthly package downloads across the inspected repositories, as reported by package registries. Registries that publish no monthly figure contribute nothing rather than zero.
Median health index
59 Moderate
The midpoint health index across the scope, computed under metrics 2.10.0.
Good or better
42% index 65 and above
Share of inspected repositories whose latest health index reaches the Good band (65) or higher.
Where the download volume sits
Combined monthly downloads by band, against repository counts.
53% of the monthly download volume under inspection flows through repositories below the good band — and the top 1% most-downloaded repositories carry 70% of the entire volume.
Repositories
17%20%24%
Download volume
17%17%17%16%
| Band | Repositories | Downloads / mo | Volume share |
|---|---|---|---|
| Exceptional | 4,418 | 98.4B | 15% |
| Excellent | 15,792 | 111B | 17% |
| Good | 18,711 | 97.3B | 15% |
| Moderate | 22,635 | 107B | 17% |
| Weak | 14,841 | 110B | 17% |
| At Risk | 12,174 | 105B | 16% |
| Critical | 4,706 | 17.3B | 2.7% |
Score shapes
The distribution behind each category median, in ten-point bins — where the record clusters, and where a category separates repositories or saturates.
Vitality68
1100
Community & Adoption44
1100
Sustainability & Governance58
1100
Engineering Quality66
1100
Security49
1100
AI Readiness57
1100
Category profile
Median category score across the scope. Categories are documented in the methodology wiki.
The state of practice
Share of inspected repositories where the practice is publicly evident. Reports that predate a signal are excluded from its basis, never counted as missing.
Engineering & community practice
Agent-era signals
Signals read by the unweighted AI Readiness category.
Does popularity mean health?
Median health index (dot) and the middle half of repositories (band) per popularity bracket, on the shared 1–100 scale.
By GitHub stars
By monthly downloads
Security under the microscope
Average OpenSSF Scorecard result per check across the scope, weakest first, on Scorecard's 0–10 scale. Check results are mostly all-or-nothing, so the average tracks how much of the record passes. Checks Scorecard reports inconclusive are excluded from scoring, never counted as zero; each row's tooltip carries its basis.
Red flags
Findings that adjust a rating downward rather than scoring into it. Each is reported as a count, as a share of the whole record, and as a rate among the repositories where it could be determined at all.
A red flag needs its own evidence, so its basis is smaller than the record. Growth authenticity is assessed only where day-by-day history was collected; dependency findings only where a dependency graph resolved. Repositories the evidence cannot answer for are left out of the basis rather than counted as passing.
The pulse
How recently each inspected repository last saw a push, at inspection time.
Half of the inspected repositories saw a push within 10 days of inspection.
Push recency
63%22%
| Last push | Repositories | Share |
|---|---|---|
| Pushed within 30 days | 58,814 | 63% |
| 31 – 90 days | 20,100 | 22% |
| 91 – 365 days | 6,117 | 6.6% |
| Over a year | 8,246 | 8.8% |
Stewardship & resilience
Who stands behind the inspected repositories, and how many people the code depends on. Both are read by the governance category.
53,007Organization-stewarded median 65
40,270Personal accounts median 53
Maintainer bus factor
78% of inspected repositories depend on a single maintainer for the majority of their commits — including 5,520 with over a million monthly downloads.
The dependency iceberg
Declared direct dependencies against the full resolved graph (direct plus transitive), across the 65,865 reports with a collected dependency graph.
The median repository declares 4 direct dependencies — and resolves to 29 packages in total.
Resolved packages per repository
License landscape
The most common detected licenses across the scope (SPDX identifiers).
Ecosystems compared
Each ecosystem's slice of the record. A repository publishing to several ecosystems counts in each. Every row opens that ecosystem's full statistics.
| Ecosystem | Inspected | Median health | Band mix | Good or better | Downloads / mo |
|---|---|---|---|---|---|
| npm | 29,723 | 65 Good | 52% | 522B | |
| Go | 28,097 | 53 Moderate | 31% | 1.5B | |
| PyPI | 13,750 | 71 Good | 60% | 98.2B | |
| Packagist | 9,305 | 56 Moderate | 31% | 5.8B | |
| crates.io | 8,283 | 67 Good | 54% | 36.1B | |
| NuGet | 4,338 | 65 Good | 51% | 6.8M | |
| RubyGems | 3,915 | 63 Moderate | 47% | 1.5B | |
| Maven | 3,260 | 71 Good | 59% | 2.4B | |
| Hex | 1,634 | 50 Moderate | 22% | 328M |
Most relied upon
The most-downloaded repositories under inspection — the records the figures above weigh heaviest. The rest is covered by the full catalogue · tag index.
npm
typescript-eslint/typescript-eslint
:sparkles: Monorepo for all the tooling which enables ESLint to support TypeScript
MITAug 27, 2026 · metrics 2.10.0
npm
jridgewell/sourcemaps
Monorepo for various sourcemap libraries
No licenseOct 21, 2026 · metrics 2.10.0
npm
npm/node-semver
The semver parser for node (the one npm uses)
ISCOct 21, 2026 · metrics 2.10.0
npm
babel/babel
🐠 Babel is a compiler for writing next generation JavaScript.
MITAug 27, 2026 · metrics 2.10.0
npm
eslint/js
Monorepo for the JS language tools.
BSD-2-ClauseOct 21, 2026 · metrics 2.10.0
npm
isaacs/minimatch
a glob matcher in javascript
BlueOak-1.0.0Oct 21, 2026 · metrics 2.10.0
Reading these figures
- Every figure is computed from the latest published inspection of each repository, under the versioned methodology (currently metrics 2.10.0). See the methodology · band scale.
- Statistics describe the inspected record — software admitted for inspection, not a random sample of all open source. Admission follows the public-interest criteria.
- Download figures come from package registries; registries that publish no monthly number (Maven Central, Go, NuGet, RubyGems) contribute no volume rather than zero. Coverage per ecosystem is documented in supported ecosystems.
- Where a signal is unavailable in a report — an uncollected dependency graph, an inconclusive Scorecard check, a report predating a signal — the repository is excluded from that figure's basis, never counted against it.
- Health indices are signals of publicly visible practice, not audits or warranties — how to read them is covered by the health index.
- Figures computed 2026-10-21 09:48 UTC; the aggregate is recomputed hourly. The underlying data is available as JSON.