aaravmaloo/revera

Revera is a command line tool that helps developers decide whether an npm package is safe and healthy to install before they run npm install. Instead of just checking for known security vulnerabilities, which is what many existing tools do, Revera looks at a package from several angles at once: how well it is maintained, how stable its programming interface has stayed over time, how secure it is, how trusted its publisher is, and how healthy the surrounding ecosystem looks based on things like download numbers and GitHub stars. The tool works like a credit score. Running a single command such as npx revera check react produces an overall score out of 100 along with a plain breakdown of why the package scored the way it did, including specific strengths and weaknesses. A related command, revera why, gives a deeper explanation, showing exactly which signals pushed the score up or down, such as a long gap since the last release or a single maintainer being responsible for the whole project. Beyond checking one package at a time, Revera can screen a package before you add it to your project, warning you if its reputation falls below a threshold you set. It can also audit an entire project's dependencies at once, including packages that are pulled in indirectly, and calculate an overall health score for the whole dependency tree. Users can log in with GitHub to raise their API rate limits, adjust settings, check system health, and manage a local cache of package data. Under the hood, the newest version of Revera builds a dependency graph of a project and scores each package using a statistical method that starts from a reasonable assumption and updates it as real data comes in, rather than guessing blindly when information is missing. This is written in TypeScript and is aimed at developers who want more confidence in the packages they depend on before adding them to a codebase.