JavaScript Open-Source Supply-Chain Review
JavaScript repository pattern findings, supply-chain review signals and scan coverage.
Report generated: 2026-11-14 17:29 UTC.
Primary repository language: JavaScript. 530 successful scans; 530 with a score, positive coverage and complete version metadata. Mean values are grouped by version; individual scores below are review prompts, not confirmed package incidents.
| Language | Scanned repos | Repos scored | Mean index / 100 | Schema / engine / scoring |
|---|---|---|---|---|
| JavaScript | 530 | 530 | 3.56 | 1.0.0 / 2.0.0 / heuristic-density-v1 |
Repository evidence
| Repository | Supply-chain index / 100 | Schema / engine / scoring | Lines scanned | Scan date |
|---|---|---|---|---|
| Superalgos/Superalgos | 99.62 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 664,301 | 2026-10-31 |
| node-red/node-red | 98.91 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 78,168 | 2026-10-31 |
| chaijs/chai | 90.42 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 34,052 | 2026-10-31 |
| facebook/hermes | 76.01 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,970,712 | 2026-10-31 |
| HabitRPG/habitica | 50.72 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 542,706 | 2026-10-31 |
| nwjs/nw.js | 44.54 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 45,718 | 2026-10-31 |
| lutzroeder/netron | 43.32 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 267,497 | 2026-10-31 |
| DietrichGebert/ponytail | 41.32 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 18,246 | 2026-10-31 |
| mozilla/rhino | 38.53 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 701,924 | 2026-10-31 |
| overleaf/overleaf | 31.89 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 517,428 | 2026-10-31 |
| release-it/release-it | 28.12 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 19,685 | 2026-10-31 |
| josdejong/mathjs | 27.62 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 164,185 | 2026-10-31 |
| JoeanAmier/TikTokDownloader | 23.97 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 42,869 | 2026-10-31 |
| apache/pouchdb | 23.70 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 120,164 | 2026-10-31 |
| tabulator-tables/tabulator | 22.35 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 73,348 | 2026-10-31 |
| qist/tvbox | 21.09 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 385,443 | 2026-10-31 |
| aframevr/aframe | 21.00 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 88,881 | 2026-10-31 |
| parse-community/parse-server | 20.60 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 197,699 | 2026-10-31 |
| framework7io/framework7 | 20.02 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 204,697 | 2026-10-31 |
| prettier/prettier | 19.20 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 247,850 | 2026-10-31 |
| hotwired/turbo | 19.10 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 18,870 | 2026-11-14 |
| UnblockNeteaseMusic/server | 18.15 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 7,489 | 2026-10-31 |
| gildas-lormeau/zip.js | 17.07 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 88,179 | 2026-10-31 |
| miroslavpejic85/mirotalk | 17.00 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 122,650 | 2026-10-31 |
| dnshe/DNSHE-FreeDomains | 16.98 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 13,435 | 2026-10-31 |
Pattern signals are prompts for human review, not proof of AI authorship, security vulnerabilities, missing packages, measured review time or code quality. Selection, scan coverage and scoring versions limit comparisons.