sherif

Scores the presence and consistency of supply-chain attestations.

Tracks the stability of the dependencies a package declares.

Scores the stability and consistency of the package maintainer over time.

Measures the maturity of the package based on its age and version history.

Evaluates risk of package scripts based on security rule matches and severities.