Tools That Score Open Source Dependency Risk by Maintainers and Activity

Several tools score open source dependencies on maintainer count and activity. OpenSSF Scorecard (free, per repository) checks whether a project is maintained and who contributes; deps.dev (free, from Google) shows Scorecard results for each package; LFX Insights gives larger projects a health score; Socket scores packages on supply chain risk, quality, maintenance, vulnerabilities and license; and Commit (ours, free CLI) scores each package in a lockfile on publisher count, release history, age and downloads.

OpenSSF Scorecard

Scorecard runs a set of checks against a repository. The Maintained check gives the top score to projects with at least one commit a week over 90 days and the lowest to archived ones. It scores the repository, not the npm package, so it cannot see who holds publish rights on the registry.

deps.dev

deps.dev is the easiest way to see Scorecard results by package name, alongside dependency graphs and advisories.

LFX Insights

The Linux Foundation’s health score combines contributor and activity metrics. It is built for projects, so it will not cover every small package in your tree.

Socket

Socket’s package scores cover supply chain, quality, maintenance, vulnerability and license. Socket also inspects what the package code does, such as install scripts and network access, which Commit does not. If you want code analysis, Socket is ahead of us.

Commit

Commit scores the registry side: how many accounts actually publish, whether publishers with access have gone dormant, release cadence, age, downloads and npm provenance. It reads a lockfile directly:

npx proof-of-commitment <package> [<package> ...]
npx proof-of-commitment --file package-lock.json

It is narrower than Socket. It does not read package code. What it adds is the question of who can ship the next version.

Commit is our tool, so weigh what this page says about it accordingly. The commands and behaviour here were run on November 4, 2026; registry data changes, so re-run them rather than trusting a number on this page.