$ grep -r "the right open-source library" github/▊
# analyze GitHub repository health, detect fake stars, and compare open-source libraries before you depend on them
## what trustoss checks
$ trustoss analyze owner/repo
Health score
A 0–100 score with a letter grade, broken into five weighted dimensions: activity, maintenance, community, documentation, and maturity — computed from public GitHub data.
$ ./star-audit --run
Fake-star audit
Plots the star growth curve and profiles recent stargazers by account age, followers, and repositories — the same signals used in fake-star research — to flag bought popularity.
$ ./deep-scan --full
Deep scan
Known vulnerabilities from OSV, real dependent packages from deps.dev, bus factor from commit concentration, CI pass rate, PR merge rate, and docs-only detection — as OK/WARN/RISK findings with evidence.
$ trustoss compare a b c
Side-by-side compare
Pick 2–4 candidate libraries and get a radar chart plus a score table across all five dimensions, with the strongest pick highlighted.
$ curl /badge/owner/repo
README badge
An embeddable SVG badge showing your repository's live TrustOSS score, ready to paste into any README.
$ npm i -g trustoss-cli
CLI & agent skill
The trustoss-cli package brings analyze, deep-scan, and star-audit to your terminal — and installs a skill so AI coding agents can vet dependencies automatically.
## how it works
- [01]
Search or paste a repo
Type keywords like “rust http client” to rank candidates, or paste owner/repo or a GitHub URL to jump straight to a report.
- [02]
Read the health report
Get the overall score and five dimension breakdowns instantly, then run the deep scan and star audit for vulnerabilities, bus factor, real adoption, and star authenticity.
- [03]
Decide and share
Every report lives at a shareable /repo/owner/name URL. Compare finalists side by side, and add the score badge to your own README.
## why stars are not enough
Researchers found roughly six million suspected fake stars on GitHub, most of them promoting short-lived malware repositories — and supply chain attacks from event-stream to xz-utils all hid behind healthy-looking popularity metrics. Star counts measure applause; they say nothing about maintenance, contributor concentration, or whether the audience is even human.
TrustOSS reads the signals that are hard to fake: who actually commits, how issues get answered, which published packages really depend on the project, and whether the stargazers look organic. Read the fake-star research breakdown →
## faq
[+]What is TrustOSS?
TrustOSS is a free web tool that analyzes the health of open-source GitHub repositories. It scores any public repository from 0 to 100, audits whether its stars are organic, scans for known vulnerabilities, and lets you compare up to four candidate libraries side by side — so you can evaluate a dependency before you install it.
[+]How is the health score calculated?
The overall score combines five weighted dimensions computed from public GitHub data: activity (25%) — last push, 90-day commit frequency, release cadence; maintenance (25%) — median issue close time, open-issue pressure, archived status; community (20%) — stars, forks, contributors; documentation (15%) — README, license, contributing guide; and maturity (15%) — project age and release history.
[+]How does the fake-star audit work?
The star audit plots the repository's star growth curve and profiles its most recent stargazers by account age, follower count, and repository count, classifying each as veteran, active developer, casual, newcomer, or empty profile. Sudden vertical spikes plus a wave of empty single-action accounts are the same signatures used in academic fake-star research to identify bought stars.
[+]What does the deep scan check?
The deep scan probes real capability beyond surface metrics: code substance (tests, CI configuration, docs-only detection), engineering health (CI pass rate, PR merge rate), known vulnerabilities from the OSV database, real adoption via dependent packages from deps.dev, bus factor from commit concentration, and star-growth authenticity. Results are reported as OK, WARN, or RISK findings with evidence.
[+]Is TrustOSS free? Do I need an account?
Yes — searching, analyzing, comparing, deep scans, star audits, and badges are free and require no account. Signing in with GitHub is only needed for the maintainer dashboard, which shows scores for your own repositories.
[+]Can I show my repository's score in its README?
Yes. Every analyzed repository gets an embeddable SVG badge at /badge/owner/name that displays its current TrustOSS score. Paste the badge markdown into your README and it stays up to date automatically.
## from the blog
- How to Evaluate an Open-Source Library Before You Depend on It: A Practical Checklist
Stars and download counts are the weakest signals a repository emits. Here is a six-part checklist — activity, maintenance, community, documentation, security, and real adoption — for evaluating any GitHub dependency before it lands in your lockfile.
2026-07-14 · 8 min read
- Bus Factor: The Dependency Risk Hiding Behind Healthy-Looking Repos
A repository can have thousands of stars, green CI, and fast releases while every meaningful commit comes from one exhausted volunteer. What the bus factor measures, why xz-utils made it a security problem, and how to check it for any GitHub dependency.
2026-07-14 · 7 min read
- Is That GitHub Repo Abandoned? Nine Signals of an Unmaintained Dependency
Repositories rarely announce their own death — they just stop answering. Nine public signals that separate an abandoned GitHub project from a stable, finished one, and how to check them before the dependency ships in your product.
2026-07-14 · 7 min read
# stop guessing from star counts — audit the repository
$ trustoss --analyze