About risk

risk scores the supply-chain risk of open-source dependencies across the npm, PyPI, and crates.io ecosystems.

What we track

Each entry is a dependency-ecosystem package discovered through its GitHub repository. For every package we record community adoption (GitHub stars), maintenance activity (last push), and issue pressure (open issues relative to stars). Via the deps.dev API we add the number of published security advisories affecting the package's default release and how stale that release is.

How the score works

The composite score (0–100) blends popularity, maintenance recency, and issue pressure. Advisory counts and version freshness from deps.dev are published alongside the score in each package's metadata, so known-vulnerability exposure is visible before you adopt a dependency. Data is refreshed every six hours.