Search an npm or PyPI package to see its security posture, known vulnerabilities, maintenance, bus-factor, and license — blended into a transparent 0–100 health/risk signal, with every factor showing its source and a confidence label. Built on public APIs: deps.dev, OSV.dev, ecosyste.ms, GitHub, and SPDX/OpenSSF. A signal explorer, not a verdict or an endorsement.