Two things live here.
conemass — rank any
dependency graph by concentration of reach. One file, no dependencies,
Apache-2.0, runs on a Cargo.lock in seconds. Ships with dated
top-1000 rankings for Debian and crates.io and the validation paper
(the xz retrodiction: liblzma5 ranked #8 of 63,436 on the last Debian
release before the backdoor was disclosed). If you came for the tool,
that repo is self-contained — start and finish there.
papers — the research programme the metric came out of: registered studies with expectations written before each run and results in dated postscripts, including the negative ones. CC-BY-4.0 text, Apache-2.0 code, archived on Zenodo and Software Heritage.