Quality grade & ranking methodology
Besides the security grade, every package gets a Denofy quality grade (S, A, B, C) from five components. Here is how it is computed — and how we keep the numbers honest.
Tiers
- Squality
≥ 85
S also needs security grade A.
- Aquality
≥ 70
- Bquality
≥ 55
- Cquality
< 55
Components and weights
Each component is scored from 0 to 100; the quality score is their weighted sum. It is recomputed daily and after every new version.
Security35%
The points of the security grade (see the security methodology).
Maintenance20%
How recently a version was published and, if known, when the upstream repository was last pushed to (60/40).
≤ 30 d: 100 · ≤ 90 d: 80 · ≤ 180 d: 60 · ≤ 365 d: 40 · > 365 d: 15
Documentation20%
A README with substance, examples or code blocks, a clear description and the optional "use when / avoid when" fields.
README ≥ 300 chars 30 · examples 25 · description ≥ 50 chars 15 · use when 20 · avoid when 10
Usage15%
Installs (distinct clients per day, last 30 days) and active installs (the most distinct clients that installed, updated or checked on one day), both on a logarithmic scale: 10 → 25, 100 → 50, 1,000 → 75, 10,000 → 100.
Ratings10%
A Bayesian average of the star ratings, so a single 5-star review does not outrank many good ones.
Prior: 5 virtual reviews with 3.5 stars; no reviews = neutral.
No inflated numbers
- Bots and crawlers are not recorded at all (user agent check).
- Installs from CI (CI, GITHUB_ACTIONS, GITLAB_CI, BUILDKITE … set) are stored separately and never counted in rankings, grades or public numbers.
- Installs count distinct clients per day: the same machine installing 1,000 times a day counts once.
- Visits of the authors to their own package page are not counted as views.
- Clients are told apart with a daily salted hash; no IP address is stored. Details: analytics & privacy.
Rankings and sorting
Top lists, trending and the "quality" sort order use the same filtered numbers. Trending compares installs in the chosen period; the quality sort uses the quality score; the grade sort uses the security grade.
Source of the rules: packages/db/src/quality.ts