People / Trust check
Is this repo safe to build on?
A score from 0 to 100 for 4.7k repos, from public signals only: whether the stars look organic, how much real use they get (forks, watchers, issues, pull requests), the owner's track record, which of 435 trusted builders vouch for it, and the OpenSSF Scorecard when there is one. New is not bad: a new repo nobody has vouched for yet is marked New, not risky. Every label is a reason to look closer, never a verdict on a person.
New and vouched: newer repos trusted builders already use
Red flags: check before running anything
Jev read the README and releases as a possible lure (free paid software, cheats, wallet tools, archives behind passwords or file hosts) at 80%+ confidence, and the repo also has a structural risk: a star pattern, very low real use, or an owner account under 180 days old.
Check first: stars that need a closer look
Star patterns that fit launch pushes and bought stars alike, or far fewer forks, watchers, issues and pull requests than repos of the same size and age.
By topic
How the score works
Stars (30%): no Check first pattern, and use not far below repos of the same size and age. Use (20%): forks, watchers, and issues plus pull requests per 1,000 stars, against peers. Owner (15%): account age, followers, public repos. References (25%): trusted builders (People index, Influence 60+, no Check first) who contribute code or send pull requests (counts 1), mention the owner on X (0.75) or follow the owner (0.5). Vouched means a trusted owner, or references that add up to 2. When an account's own repos carry a Check first pattern, its other repos are checked first too, whatever their references. Hygiene (10%): OpenSSF Scorecard, or license and recent pushes.
Repos that ship executables or archives, have an owner account under 180 days old, or show a star pattern get one more question to Jev (TypeSafe jev-1.13.0) about how they ask people to install them. Nothing here is collected from private data, and nothing is a claim about anyone's intent.