https://ossatrisk.org/
ossatrisk - Tracking high-risk oss packages: abandoned, undermaintained, or CVE-exposed.
ossatrisk surfaces widely-used open source packages that carry silent risk: abandoned maintenance, unpatched CVEs, or single-maintainer bus factor.
high risktrackingoss