Rust Open-Source Supply-Chain Review
Rust repository pattern findings, supply-chain review signals and scan coverage.
Report generated: 2026-11-14 17:29 UTC.
Primary repository language: Rust. 483 successful scans; 483 with a score, positive coverage and complete version metadata. Mean values are grouped by version; individual scores below are review prompts, not confirmed package incidents.
| Language | Scanned repos | Repos scored | Mean index / 100 | Schema / engine / scoring |
|---|---|---|---|---|
| Rust | 483 | 483 | 1.71 | 1.0.0 / 2.0.0 / heuristic-density-v1 |
Repository evidence
| Repository | Supply-chain index / 100 | Schema / engine / scoring | Lines scanned | Scan date |
|---|---|---|---|---|
| denisidoro/navi | 30.62 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 6,291 | 2026-10-31 |
| rui314/mold | 27.41 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 152,973 | 2026-10-31 |
| EpicGames/lore | 23.95 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 716,286 | 2026-10-31 |
| FalkorDB/FalkorDB | 21.17 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 231,167 | 2026-10-31 |
| jely2002/youtube-dl-gui | 19.08 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 61,169 | 2026-10-31 |
| rust-lang/rustfmt | 18.27 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 113,739 | 2026-10-31 |
| waditu/czsc | 18.11 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 84,844 | 2026-10-31 |
| alacritty/alacritty | 14.38 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 39,294 | 2026-10-31 |
| Eventual-Inc/Daft | 13.97 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 519,380 | 2026-10-31 |
| bensadeh/tailspin | 13.42 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 10,756 | 2026-10-31 |
| ramensoftware/windhawk | 13.41 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 451,041 | 2026-10-31 |
| oven-sh/bun | 12.46 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 5,965,907 | 2026-10-31 |
| pola-rs/polars | 11.22 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 967,346 | 2026-10-31 |
| n0-computer/iroh | 9.75 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 70,693 | 2026-10-31 |
| NVIDIA-NeMo/Switchyard | 9.41 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 229,610 | 2026-10-31 |
| RustPython/RustPython | 9.36 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,644,144 | 2026-10-31 |
| ankitects/anki | 9.35 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 200,530 | 2026-10-31 |
| rerun-io/rerun | 9.24 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,104,745 | 2026-10-31 |
| cjpais/Handy | 9.03 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 96,198 | 2026-10-31 |
| TabbyML/tabby | 7.91 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 188,093 | 2026-10-31 |
| kanidm/kanidm | 7.72 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 448,487 | 2026-10-31 |
| kitao/pyxel | 7.61 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 158,899 | 2026-10-31 |
| signalapp/libsignal | 7.10 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 409,210 | 2026-10-31 |
| xberg-io/xberg | 6.86 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 2,287,388 | 2026-10-31 |
| svix/svix-webhooks | 6.79 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 285,373 | 2026-10-31 |
Pattern signals are prompts for human review, not proof of AI authorship, security vulnerabilities, missing packages, measured review time or code quality. Selection, scan coverage and scoring versions limit comparisons.