Six things a repository cannot tell you.

Read from the registries, not from git. Every "is this maintained" badge in circulation reads a repository’s last push — but a push is what a maintainer does for themselves, and a release is what reaches the projects depending on them. The two come apart constantly.

A tag is a moving target — the image behind it today is not the one behind it last month. That is why the rebuild date is here: a tag nobody has rebuilt in months is shipping months of unpatched distribution packages, and it looks identical to one built this morning. Sizes are what Docker Hub reports for the compressed image.

These names exist on npm and are one edit from a package people install. That is the entire claim. None of them is being called malicious, and none should be read that way — near names are routinely forks, ports, translations, or somebody’s abandoned first attempt. Only deletions and transpositions are swept, so this finds fewer than exist and never claims to be a complete list.

Not a survey of any ecosystem. A few dozen hand-picked projects per registry, chosen for being prominent, which is exactly the population most likely to have advisories filed against it. Counts are all-time, so age and scrutiny raise them as readily as danger does. The registries are not the same size or the same age, and per-package is the only comparison worth making — even that one is soft.

The bus factor is how many contributors, from the most prolific down, account for half the commits. One means half a project’s history came from a single person. Three things it is not: commit count is not contribution, and review, triage and documentation leave few commits while a project cannot run without them; it is history rather than the present, so a founder who left three years ago still dominates; and a low number is a fact about a distribution, never an accusation about anybody. A contributor count with a plus sign was capped at a hundred.

Volume has fallen across nearly every tag on Stack Overflow since assistants started answering these questions instead, so a tag falling is the baseline rather than the finding — the median tag here moved -24.2%. What survives that is the last column: how a tag moved against the rest over the same window. Under 25 questions in the earlier window there is no percentage at all, because four to two is a fifty percent collapse and means nothing.