Not on their own. Popularity is useful for two things: confirming you have the real package rather than a lookalike, and judging whether you will find help and scrutiny. It is a weak measure of security, because counts can be inflated, and a popular package can still be poorly maintained.
What popularity can tell you
The OpenSSF Concise Guide includes an Adoption rule: assess whether the software has significant use, because widely used software is more likely to have useful security guidance and more people who care about its security. It pairs that with Name Verification: check whether a similarly named package is more popular, since that could indicate typosquatting.
Both are sensible. Popularity is a way to catch the wrong package and to see if a community exists. It is not an audit.
What popularity cannot tell you
| Question | Do stars or downloads answer it? |
|---|---|
| Is it the package I meant | Partly, as a comparison against lookalikes |
| Is it maintained today | No. Counts keep growing after maintainers leave |
| Are changes reviewed | No |
| Is this version safe | No |
| Will fixes ship quickly | No |
The Guide also warns against hype driven choices. It says to choose software that is a good solution for the problem, not because large companies use it or because it is the latest fad.
A simple way to use the numbers
- Search the registry for your intended name and for near variants. If a variant has far more downloads, double check which you want.
- Compare creation dates. A package created last week with a familiar name deserves suspicion. The Guide lists creation time next to popularity in its authenticity check.
- Check that the repository link on the package page leads to a real repository whose name and owner match.
- Then move on to maintenance, release recency and review practice, which carry the security meaning.
A short worked example
Suppose two packages do the same job. One has many downloads, a last release three years ago and no security policy. The other has fewer downloads, a release last month and a clear SECURITY.md. Popularity favors the first, but the other signals favor the second. Neither is a verdict. The right move is to ask what each could do inside your build and decide with that in mind.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each component in an inventory can be reviewed against more than a popularity count.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning and policies and gates, so adoption of a new package can go through the same review as everything else. A free scan is at gold.safeguard.sh/scan.
Quick check
Are download counts easy to inflate?
They can be affected by mirrors, CI traffic and automation, so treat them as rough indicators and not as proof of real use.
Is a package with few stars risky?
Not necessarily. It may be small or new. Judge it on maintenance, review and provenance.
Sources
Last reviewed: 19 October 2026.
