Analyzing Open Source Repository Health and Maintainer Concentration

Description and use

Analysis of 60,000+ repositories reveals high maintainer concentration (74% single-maintainer) and low adoption of security policies (19%). Surprisingly, the most downloaded packages (100M+ monthly) have a lower median health score (54) than less popular ones, attributed to stable, unmaintained utility libraries like ansi-regex and emoji-regex. This highlights a flaw in current scoring models that cannot distinguish between abandoned and completed projects.

Problem

Understanding the health, security practices, and maintainer concentration of open-source repositories across major package ecosystems to identify risks and scoring model limitations.

Outcome

Analysis of 60,000+ repositories reveals high maintainer concentration (74% single-maintainer) and low adoption of security policies (19%). Surprisingly, the most downloaded packages (100M+ monthly) have a lower median health score (54) than less popular ones, attributed to stable, unmaintained utility libraries like ansi-regex and emoji-regex. This highlights a flaw in current scoring models that cannot distinguish between abandoned and completed projects.

Workflow

• Index over 60,000 repositories across npm, Go, PyPI, Packagist, crates.io, RubyGems, Maven, and others.
• Track monthly download volumes, totaling roughly 460 billion.
• Analyze maintainer concentration using GitHub's contributors API (excluding bots).
• Evaluate security practices including presence of README, License, Automated tests, CI, Linter config, Docs, Contributing guide, and Security policy.
• Calculate OpenSSF Scorecard metrics such as CII-Best-Practices, Fuzzing, Branch-Protection, SAST, Pinned-Dependencies, Token-Permissions, Code-Review, License, and Dangerous-Workflow.
• Correlate health scores with download tiers to identify anomalies.
• Publish methodology (version 2.10.0) and insights publicly.
• Acknowledge limitations in scoring models regarding stable vs. abandoned projects.

Evidence

74% of repositories depend on a single maintainer for the majority of their commits.

Source

Security policy 19%

Source

Median health score by download tier: 100M+ → 54

Source