Recommended Free Tools
Census II is a 2022 study of free and open-source software (FOSS) application libraries observed in production applications—not a definitive or current ranking of the most important open-source projects. The Linux Foundation and the Laboratory for Innovation Science at Harvard (LISH), with support from the Open Source Security Foundation (OpenSSF), released the report on March 2, 2022. It used anonymized software-composition-analysis data to examine how companies used application libraries and to highlight issues affecting software supply-chain health.
What Census II studied
Census II followed the first Linux Foundation Census, which focused on lower-level operating-system libraries and utilities. The second study shifted to the application-library layer: packages incorporated into applications, including through dependencies. Its goal was to identify FOSS libraries widely deployed in production and help focus attention on software security and health. The report was authored by Frank Nagle, James Dana, Jennifer Hoffman, Steven Randazzo, and Yanuo Zhou. Read the Census II report.
The Linux Foundation’s release described a set of more than 1,000 widely deployed application libraries. The report’s appendices present eight separate Top 500 lists, each reflecting a different slice of the data rather than a single all-purpose ranking. The March 2, 2022 announcement also summarizes the study’s purpose and headline findings.
Where the data came from—and what the lists mean
The study combined more than half a million observations of FOSS libraries used in production applications at thousands of companies. The anonymized data came from software composition analysis (SCA) scans supplied by Snyk, Synopsys Cybersecurity Research Center (CyRC), and FOSSA. SCA tools inventory software components in codebases; here, their data provided a view into use in private production environments that is not generally visible from public repositories alone.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Census II separated packages along three axes. To interpret or compare a list, match all three:
- Ecosystem: npm or non-npm. npm was separated because it was heavily represented and could dominate a combined list.
- Dependency relationship: direct dependencies called by the application, or direct plus indirect dependencies brought in through another package.
- Version handling: version-agnostic package names, or entries retaining version numbers.
For example, the release announcement’s top ten version-agnostic npm packages called directly in applications were, in order: lodash, react, axios, debug, @babel/core, express, semver, uuid, react-dom, and jquery. That is a result for one specific slice of the partner data—not a statement about today’s package popularity, the most critical projects, or all FOSS use.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Five issues the study brought into focus
Inconsistent component naming
Data providers used different names and conventions for software components, making records harder to reconcile. The authors argued that standardized identification would improve communication and supply-chain transparency. For organizations maintaining inventories or bills of materials, inconsistent identifiers can make it difficult to tell whether records refer to the same component.
Version information is complicated
Package-version data did not always align consistently between records and public repositories. The release announcement recommended that SBOM guidance align version information with a package’s public main repository rather than private repositories. This is the report’s recommendation; it should not be read as a description of every current SBOM standard.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Contributor activity can be concentrated
In one dataset, 136 developers were responsible for more than 80% of the lines of code added to the top 50 packages. This finding is limited to that dataset; it does not establish the same pattern across all projects or contributors, and contributor count alone does not measure project health. The report’s practical implication is that organizations relying on a package may have reason to support its maintainers.
Maintainer account security matters
A maintainer’s individual developer account can be a consequential point of control: if compromised, it may affect software distributed downstream. Census II highlighted developer-account security as an increasing concern in the open-source supply chain.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Legacy components remain in use
Old or infrequently updated components can persist in application dependencies. The report suggested that such projects may need revitalization—or that users may need help moving to newer alternatives. Their presence in a dependency inventory is a reason to investigate maintenance and transition options, not by itself proof of a vulnerability.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to use Census II without overreading it
The report itself says its findings are indicative, not a definitive claim about which FOSS packages are most critical. The sample was limited to the SCA partners’ customer bases; privacy restrictions also prevented sufficiently specific data for representative sampling. In addition, some dependency calculations depended on package-identification information from Libraries.io or GitHub, so packages absent from those sources could be omitted or ranked lower.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
In practical terms, the lists measure observed use within the study’s scope. They do not measure each package’s vulnerability level, its importance to critical infrastructure, or the risk of relying on it. They can help direct questions—such as which dependencies deserve an inventory or maintenance review—but they are not a standalone risk score or a sufficient basis for funding and policy decisions.
The report also included an OpenSSF Best Practices badge “Tiered %” measure alongside package lists. It indicates progress against practices: 100% or above corresponds to passing, 200% or above to silver, and 300% or above to gold. It is not a vulnerability score.
Is Census II still current?
No: Census II is a historical 2022 snapshot. The Linux Foundation lists a later application-library study, Census III, which used data from FOSSA, Snyk, Sonatype, and Black Duck. The existence of that successor does not establish which individual packages are most used today; a current ranking requires the successor report’s own dated data and methods. See the Linux Foundation’s Census III page.
When comparing Census II with another list or study, check its study period, participating data providers, package-identification method, and represented population as well as whether the lists use the same ecosystem, dependency relationship, and version treatment. Otherwise, apparent rank changes may reflect different coverage or definitions rather than a real change in usage.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why the findings matter
Census II’s value is less a timeless leaderboard than a structured look at issues that make open-source supply chains harder to understand and sustain: identifying components consistently, recording versions reliably, protecting maintainer accounts, and supporting projects whose use may exceed the visible contributor base. Brian Behlendorf, then executive director of OpenSSF, said in the March 2, 2022 release announcement that understanding widely used packages lets the community engage projects that warrant operations and security support. That rationale is useful, provided the report’s sample and scope remain attached to any conclusion drawn from its rankings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
