Health-index distribution
Latest health index of every inspected repository, in five-point intervals over the 1–100 scale.
median 57
Critical · 1977At risk · 8992Moderate · 16495Good · 5961Excellent · 515
Aggregate statistics across the public record — how software health distributes, where the download volume concentrates, and which engineering practices are common or rare. Figures describe the inspected record, not the entirety of open source.
Latest health index of every inspected repository, in five-point intervals over the 1–100 scale.
Combined monthly downloads by band, against repository counts.
77% of the monthly download volume under inspection flows through repositories below the good band — and the top 1% most-downloaded repositories carry 64% of the entire volume.
| Band | Repositories | Downloads / mo | Volume share |
|---|---|---|---|
| Excellent | 515 | 19B | 5.0% |
| Good | 5,961 | 66.6B | 18% |
| Moderate | 16,495 | 132B | 35% |
| At risk | 8,992 | 121B | 32% |
| Critical | 1,977 | 39.6B | 10% |
The distribution behind each category median, in ten-point bins — where the record clusters, and where a category separates repositories or saturates.
Median category score across the scope. Categories are documented in the methodology wiki.
Share of inspected repositories where the practice is publicly evident. Reports that predate a signal are excluded from its basis, never counted as missing.
Signals read by the unweighted AI Readiness category.
Median health index (dot) and the middle half of repositories (band) per popularity bracket, on the shared 1–100 scale.
Average OpenSSF Scorecard result per check across the scope, weakest first, on Scorecard's 0–10 scale. Check results are mostly all-or-nothing, so the average tracks how much of the record passes. Checks Scorecard reports inconclusive are excluded from scoring, never counted as zero; each row's tooltip carries its basis.
Findings that adjust a rating downward rather than scoring into it. Each is reported as a count, as a share of the whole record, and as a rate among the repositories where it could be determined at all.
A red flag needs its own evidence, so its basis is smaller than the record. Growth authenticity is assessed only where day-by-day history was collected; dependency findings only where a dependency graph resolved. Repositories the evidence cannot answer for are left out of the basis rather than counted as passing.
How recently each inspected repository last saw a push, at inspection time.
Half of the inspected repositories saw a push within 2 days of inspection.
| Last push | Repositories | Share |
|---|---|---|
| Pushed within 30 days | 27,868 | 82% |
| 31 – 90 days | 1,314 | 3.9% |
| 91 – 365 days | 2,078 | 6.1% |
| Over a year | 2,680 | 7.9% |
Who stands behind the inspected repositories, and how many people the code depends on. Both are read by the governance category.
73% of inspected repositories depend on a single maintainer for the majority of their commits — including 1,771 with over a million monthly downloads.
Declared direct dependencies against the full resolved graph (direct plus transitive), across the 23,178 reports with a collected dependency graph.
The median repository declares 3 direct dependencies — and resolves to 27 packages in total.
The most common detected licenses across the scope (SPDX identifiers).
Each ecosystem's slice of the record. A repository publishing to several ecosystems counts in each. Every row opens that ecosystem's full statistics.
| Ecosystem | Inspected | Median health | Band mix | Good or better | Downloads / mo |
|---|---|---|---|---|---|
| npm | 10,674 | 60 Moderate | 26% | 320B | |
| Go | 10,070 | 53 Moderate | 14% | 1.2B | |
| PyPI | 5,259 | 62 Moderate | 32% | 51.6B | |
| Packagist | 3,151 | 58 Moderate | 17% | 3.9B | |
| crates.io | 2,462 | 62 Moderate | 27% | 12.5B | |
| RubyGems | 2,105 | 56 Moderate | 19% | 459M | |
| Hex | 1,096 | 51 Moderate | 7% | 253M | |
| Maven | 870 | 65 Moderate | 36% | 518M | |
| NuGet | 561 | 56 Moderate | 13% | 6M |
The most-downloaded repositories under inspection — the records the figures above weigh heaviest. The rest is covered by the full catalogue · tag index.