Health-index distribution
Latest health index of every inspected repository, in five-point intervals over the 1–100 scale.
median 51
Critical · 45At risk · 451Moderate · 528Good · 71Excellent · 1
Aggregate statistics across every inspected repository publishing to Hex — how health distributes, where the download volume sits, and which practices are common or rare, measured against the whole record.
Latest health index of every inspected repository, in five-point intervals over the 1–100 scale.
Combined monthly downloads by band, against repository counts.
56% of the monthly download volume under inspection flows through repositories below the good band — and the top 1% most-downloaded repositories carry 63% of the entire volume.
| Band | Repositories | Downloads / mo | Volume share |
|---|---|---|---|
| Excellent | 1 | 27M | 11% |
| Good | 71 | 83.5M | 33% |
| Moderate | 528 | 112M | 44% |
| At risk | 451 | 26.6M | 10% |
| Critical | 45 | 4.7M | 1.8% |
The distribution behind each category median, in ten-point bins — where the record clusters, and where a category separates repositories or saturates.
Median category score across the scope. Ticks mark the whole-record median. Categories are documented in the methodology wiki.
Share of inspected repositories where the practice is publicly evident. Reports that predate a signal are excluded from its basis, never counted as missing.
Signals read by the unweighted AI Readiness category.
Median health index (dot) and the middle half of repositories (band) per popularity bracket, on the shared 1–100 scale.
Average OpenSSF Scorecard result per check across the scope, weakest first, on Scorecard's 0–10 scale. Check results are mostly all-or-nothing, so the average tracks how much of the record passes. Checks Scorecard reports inconclusive are excluded from scoring, never counted as zero; each row's tooltip carries its basis.
Findings that adjust a rating downward rather than scoring into it. Each is reported as a count, as a share of the whole record, and as a rate among the repositories where it could be determined at all.
A red flag needs its own evidence, so its basis is smaller than the record. Growth authenticity is assessed only where day-by-day history was collected; dependency findings only where a dependency graph resolved. Repositories the evidence cannot answer for are left out of the basis rather than counted as passing.
How recently each inspected repository last saw a push, at inspection time.
Half of the inspected repositories saw a push within 42 days of inspection.
| Last push | Repositories | Share |
|---|---|---|
| Pushed within 30 days | 468 | 43% |
| 31 – 90 days | 209 | 19% |
| 91 – 365 days | 257 | 23% |
| Over a year | 162 | 15% |
Who stands behind the inspected repositories, and how many people the code depends on. Both are read by the governance category.
78% of inspected repositories depend on a single maintainer for the majority of their commits — including 13 with over a million monthly downloads.
Declared direct dependencies against the full resolved graph (direct plus transitive), across the 863 reports with a collected dependency graph.
The median repository declares 0 direct dependencies — and resolves to 0 packages in total.
The most common detected licenses across the scope (SPDX identifiers).
The most-downloaded repositories under inspection publishing to Hex — the records the figures above weigh heaviest. The rest is covered by the full catalogue · tag index.