About
We built the thing we kept rebuilding by hand.
Substrate started as a spreadsheet. Before every large upgrade we found ourselves checking the same handful of things for each dependency: when did it last ship, is anyone still committing, how many people can publish it, is there an advisory open against the version we run. The spreadsheet became a script, and the script became this.
What we hold to
Every number traces to a public fact
A score is only useful if you can audit it. Each sub-score maps to something checkable, a publish date, an archived flag, an advisory ID, and the weights are published rather than tuned in private.
Missing data is not bad data
A package with no public repository is not unhealthy, it is unmeasured. Where a signal is unavailable its weight is redistributed, and the interface says so rather than quietly scoring it zero.
Popularity is not health
The most dangerous dependency is not the obscure one. It is the package pulled fifty million times a month that stopped being maintained six years ago, and which nobody re-examined because everyone uses it.
A declaration outranks an inference
When maintainers mark a package deprecated or archive its repository, that is not one signal among many to be averaged away by strong download numbers. It caps the score outright.
What Substrate does not know
A health score is a strong prior, not a verdict. These are the things it cannot see, stated plainly so you can weigh them yourself.
- Whether a quiet package is abandoned or simply finished. Some libraries are done, and staleness reads the same either way.
- Announcements made outside the registry. A project can be in maintenance mode for years without ever setting a deprecated flag.
- How much of a dependency you actually use. One import is not the same exposure as two hundred call sites.
- Private and internal packages. Substrate reads public registries only, npm and PyPI today.
- Whether an advisory is exploitable in your context. A vulnerability in a code path you never call still counts against the score.
Judge it on your own dependencies.
The fastest way to decide whether the model is any good is to point it at two packages whose health you already have an opinion about.
Open the compare tool