OSS + ELC EU 2026

Open source software powers critical digital infrastructure across every industry. But, how do you know if the software you are depending on is actually healthy? A project that looks active may have one key maintainer. A package you've never heard of may be a single point of failure for thousands of downstream projects. npm's scale and deep dependency chains turn that uncertainty into real supply chain risk – remember Shai-Hulud?

Based on learnings from open source community health analytics projects like CHAOSS, OpenSSF Scorecard, and GrimoireLabs, Bloomberg and AboutCode are building an open, data-driven framework that applies the Goal-Questions-Metrics methodology to assess project health across the npm ecosystem.

This talk presents our npm Health Model and open source tooling, early findings, and how this approach can extend to other OSS project ecosystems. We are sharing the model, methodology, data, and tooling openly so other organizations can apply it to their own processes. Attendees will leave with a practical framework for assessing open source health at scale, and a path to contributing to this open effort.