Hygiene & licensing
Dormant packages aren't just stale, they're insecure
Repositories with no release in two years average 2.6/10 on the Scorecard, against 4.5 for active ones.
- Headline statistic
- 2.6 / 10
- 2026 edition
OpenSSF Scorecard by repository activity
Active repositories average 4.5 out of 10, compared with 2.6 for repositories with no release in two years.
Repositories are split by whether they released in the last two years, then compared by average OpenSSF Scorecard score.
Source: FOSS Data — https://www.fossdata.org
Interactive visualization is optional. Exact values are available in the data table below.
Data table
Scroll horizontally to review every data column when needed.
| Repository activity | Average OpenSSF Scorecard score |
|---|---|
| Active | 4.5 / 10 |
| Dormant | 2.6 / 10 |
Supporting explanation
Repositories with no release in two years average 2.6/10 on the Scorecard, against 4.5 for active ones. Abandonment and weak security travel together.
Publication details
- Category
- Hygiene & licensing
- Applicable filter
- Category: Hygiene & licensing
- Edition
2026 edition
Measured 25 June 2026
Published 2 August 2026
- Source
- Based on the Exodos Labs provenance dataset.