Skip to content
Indexing 1.24M Create your free library

INDEX LIVE · UPDATED 12s AGO

The cross-ecosystem index of 1.2M+ open-source packages — scored on production readiness, not stars.

Search npm, PyPI, Maven, crates.io, Go modules, and RubyGems from one interface. Every package carries a 0–100 Production Readiness score built from real download velocity, issue half-life, bus-factor, and CVE history.

Create your free library Browse the index

Indexing 1,247,392 packages · updated 12s ago · 9.4M API requests/day

PRODUCTION READINESS INDEX · WEEK 12, 2026

Top-ranked packages this week across the full index.

# Package Ecosystem Score License Last release
01 zod TypeScript-first schema validation npm 96 MIT 2 days ago 02 requests Python HTTP for humans PyPI 94 Apache-2.0 5 days ago 03 tokio Async runtime for Rust crates 93 MIT 1 day ago 04 hono Ultrafast web framework for the edge npm 93 MIT 3 days ago 05 spring-boot-starter Opinionated JVM application framework Maven 91 Apache-2.0 1 week ago 06 openai-python Official OpenAI Python client PyPI 91 Apache-2.0 4 days ago 07 rubocop Ruby static code analyzer RubyGems 89 MIT 6 days ago 08 cobra CLI library for Go Go 89 Apache-2.0 2 days ago

Scores recompute every 6 hours · methodology audited quarterly · raw data exportable as Parquet under CC-BY-SA 4.0

See the full 1.2M+ →

METHODOLOGY · PUBLIC & REPRODUCIBLE

What goes into a 0–100 Production Readiness score.

GitHub stars measure hype. The OpenLib Production Readiness Index measures what actually happens when you ship the dependency to production. Four signals, weighted by impact, recomputed every six hours across the full 1.2M-package index.

  1. 01

    Download velocity

    Weight: 30%

    Weekly download volume from each registry, normalized per-ecosystem. Detects packages in real production use vs. ones sitting in a README.

  2. 02

    Issue half-life

    Weight: 25%

    Median time from issue open to maintainer response, weighted by severity. Measures how alive the maintainer actually is.

  3. 03

    Bus-factor

    Weight: 20%

    Distribution of commits across contributors. A single-dev package with 50k stars still scores lower than a healthy 12-maintainer project.

  4. 04

    CVE history

    Weight: 25%

    Count and severity of disclosed CVEs over the trailing 24 months, patched within 30 days. Refreshed every 15 minutes via the NVD feed.

Curious about the exact weights, edge cases, or how we handle archived packages? The full formula is public.

Read the methodology →

ONE INDEX · SIX REGISTRIES

One index, six ecosystems — pick your registry.

Every ecosystem tab filters the same 1.2M-package catalog in place. No redirects, no second accounts.

  • npm 412,847 JavaScript · TypeScript
  • PyPI 387,221 Python
  • Maven 218,604 JVM · Java · Kotlin · Scala
  • crates.io 112,390 Rust
  • Go modules 86,512 Go
  • RubyGems 29,818 Ruby
Create your free library Query the public API →

WHAT "INDEXED CONTINUOUSLY" ACTUALLY MEANS — MEASURED.

The catalog, in hard numbers.

1,247,392

packages indexed

across 6 registries · growing ~1.2k/day

180ms

avg query latency

p95 across the full index, measured weekly

15min

CVE refresh

NVD feed · not real-time, but close

99.97%

API uptime

trailing 12 months · 9.4M req/day

Full data export available as Parquet under CC-BY-SA 4.0 · indexer is open source on GitHub