Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.
C-Rank Grade: B (Solid) - 55/100
External PR Merge Rate: 71%
Response Time: 5h
First Timer Success: -
mkbhardwas12/pwned-deps has a recorded first-timer success rate of 0.0%. Repositories ranked B typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in mkbhardwas12/pwned-deps respond to incoming external pull requests in approximately 5.2 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 54.7 places mkbhardwas12/pwned-deps in the B tier.
The external contributor pull request merge rate for mkbhardwas12/pwned-deps is 71.4%, based on public PR activity from non-core contributors.
mkbhardwas12/pwned-deps currently has 4 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.
Collaborative maintainer environment in mkbhardwas12/pwned-deps. Reviews community pull requests with focus on project quality.
Discussions in mkbhardwas12/pwned-deps focus heavily on practical implementation feedback, code formatting standards, and issue reproduction details.
Unlinked PRs without issue context and changes that fail automated test suites face the highest review friction.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/mkbhardwas12/pwned-deps?utm_source=github&utm_medium=badge)
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 00:00 UTC (00:00 UTC in your timezone). Recommended submission window is Monday - Friday from 00:00 to 04:00 UTC (00:00 - 04:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~4 hours (89% approval). Large PRs (>500 lines) take ~25 hours (32% approval). Keep your diff compact for rapid review.
Publish ghcr.io/mkbhardwas12/pwned-deps:<version> from release.yml (distroless Python, non-root, SBOM + provenance attested with docker/build-push-action + actions/attest-build-provenance), and add a copy-paste GitLab CI template under examples/gitlab/ that uses it. Done when the image is built and pushed by the release workflow (SHA-pinned actions, same version gate), docker run --rm -v "$PWD":/src ghcr.io/mkbhardwas12/pwned-deps check /src works, and the README CI section links the template.
Several bundled campaigns are account hijacks but are described only by exact bad versions. Adding a compromised_maintainers block (name + compromised_after / compromised_until) lets 0.2.0's timestamp resolution confirm any version published in the window — including ones a source blog missed. Candidates (all in src/pwned_deps/extras_data/extras.json): EXTRA-2021-0001 ua-parser-js (npm) — hijack window per the maintainer's GitHub issue EXTRA-2021-0002 coa, EXTRA-2021-0003 rc (npm) — same operator, ~4h windows EXTRA-2022-0001 ctx (PyPI) — expired-domain takeover; window from the PyPI upload times EXTRA-2023-0001 @ledgerhq/connect-kit — ex-employee phishing, ~5h window Rules: cite the source for both timestamps, keep the window conservative (see CONTRIBUTING.md — a too-wide window produces false CONFIRMEDs), and add a test asserting the in-window fixture version is CONFIRMED and an out-of-window one is cleared (mock the registry like tests/advisory/test_registry_and_min
0.2.0 shipped --min-age and maintainer-window confirmation for npm + PyPI only (src/pwned_deps/advisory/registry.py). Other ecosystems are silently skipped by the policy. Sources: crates.io — https://crates.io/api/v1/crates/<name>/versions → versions[].created_at (needs a descriptive User-Agent; already set) RubyGems — https://rubygems.org/api/v1/versions/<name>.json → created_at Go — https://proxy.golang.org/<module>/@v/<version>.info → Time (module path must be case-escaped: !m for uppercase) Maven — Maven Central search https://search.maven.org/solrsearch/select?q=g:<g>+AND+a:<a>+AND+v:<v> → timestamp (ms) Done when each has a _<eco>_publish_time() in RegistryClient, SUPPORTED is extended, the CLI help text and README network-footprint list are updated, and tests mock each endpoint (see tests/advisory/test_registry_and_min_age.py).
Add packages.lock.json (NuGet, dotnet restore --use-lock-file) support. Shape: JSON; dependencies → target framework → package name → { "type": "Direct|Transitive", "resolved": "1.2.3" }. OSV ecosystem string is NuGet. Package IDs are case-insensitive — normalise to the registry casing or lowercase consistently. Done when src/pwned_deps/parsers/nuget.py, Ecosystem.NUGET = "NuGet", detector entry Fixture + tests (dedupe the same package across multiple target frameworks) README row
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to mkbhardwas12/pwned-deps, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of mkbhardwas12/pwned-deps acknowledge new external contributions in approximately 5 hours. Out of all submitted pull requests from non-core authors in the last 180-day window, 71.4% were successfully merged into the primary branch.
mkbhardwas12/pwned-deps has a recorded first-timer success rate of 0.0%. Repositories ranked Solid typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~5 hours. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 54.7 places mkbhardwas12/pwned-deps in the Solid tier.
The external pull request merge rate is 71.4%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, mkbhardwas12/pwned-deps currently has 4 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for mkbhardwas12/pwned-deps are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.