Product
Score a package, scan your stack, and see how to fix what’s broken.
Substrate scores open-source dependencies 0–100 from live public data, and it is deliberately not a black box. Every number traces back to a checkable fact (a publish date, an archived flag, an advisory ID), so if you disagree with a score, you can see exactly which input you disagree with.
How the score is composed
Release age, blended with commit activity
Cadence, issue pressure, bus factor, deprecation
Advisories affecting the current version
Downloads, stars and contributors, log-scaled
Where a signal is unavailable (a package with no public repository, for instance) its weight is redistributed rather than counted as zero. Missing data is not evidence of a problem.
Dependency Health Score
A 0–100 score for any package, with every input shown.
Enter a package and get a single 0–100 health score, built from four visible sub-scores: recency, maintenance, security and adoption. No black box, the inputs and weights are published, so you can argue with them. Try it in the compare tool.
- Recency blends release age with commit activity, weighted 60/40 toward releases: users only receive fixes that ship.
- Maintenance reads release cadence, open issues per contributor, publish-rights concentration, and explicit deprecated or archived flags.
- Security counts advisories that affect the version you would install today, not every CVE ever filed against the package.
- Adoption is measured on a log scale across downloads, stars and contributor count, so a healthy niche library is not scored as though it were abandoned.
Risk Radar
Paste a package.json, score your whole stack at once.
Scan an entire package.json and every dependency is scored and ranked worst-first, including the transitive ones you never chose directly. The free scan is point-in-time; continuous monitoring and alerting is the paid tier. Try it on the scan page.
- Scores every direct dependency, plus one level of the transitive ones they pull in.
- Ranks worst-first, so the packages worth arguing about are at the top.
- Flags deprecated, archived, stale and vulnerable packages at a glance.
- Paid tier adds continuous monitoring: drift, new advisories and bus-factor alerts over time.
Migration Advisor
For dying packages, names healthier replacements.
When a dependency scores badly, Substrate names healthier alternatives and links straight to a comparison that proves the replacement is better. Where the migration is large, our consulting team picks up the work.
- Suggests ranked alternatives, scored on the same scale so the comparison is like for like.
- Each suggestion links to a live side-by-side comparison you can check yourself.
- Surfaces on both the compare tool and a full stack scan.
- Hands off to remediation engineers when the change is too large to absorb in-sprint.
The scoring engine is already running.
The compare tool uses the same model described on this page, against live public data. No account, no install.
Try it on your own dependencies