Choosing dependencies is an unsolved problem

OpenLib exists because every engineer has made this mistake: picked a library by stars and vibes, shipped it into production, and spent the next quarter paying for a maintainer who vanished, a license that lawyered up, or a CVE nobody watched. The package registries tell you what exists; they do not tell you what is safe to bet a product on. OpenLib is the missing layer between those two facts.

What the index provides

OpenLib continuously indexes more than a million packages across the major ecosystems — npm, PyPI, Maven, crates.io, Go modules, and more — and scores them on signals that survive contact with production:

• Real usage: adoption measured from actual production signals, not download counters inflated by CI pipelines.
• Maintainer health: release cadence, issue half-life, bus factor, and the community signals that predict whether help will exist in a year.
• License fitness: plain-language license analysis and compatibility flags before the legal review finds out.
• Security history: CVE records and dependency-tree exposure, tracked per package over time.

Our principles

The index is open: scores, methodology, and raw signals are published and inspectable, and the core dataset is free for everyone — individual engineers should not need a budget to choose dependencies well. Teams use the API and workspace features to enforce standards across their organizations.

Dependencies are the riskiest decisions most teams make casually. OpenLib makes them deliberate — search, compare, and depend on open source with your eyes open.