The Problem with Star Counts
Star counts are the most visible ranking signal for DSH plugins — and the easiest to manipulate. A plugin can buy stars, run a coordinated upvote campaign, or game the GitHub trending algorithm. Self-reported ratings on install pages are even easier to fake: nothing stops the author from rating their own plugin five stars.
What Our Independent Scoring Actually Measures
DSH Quality does not ask plugins to rate themselves. Instead, we compute a score from hard signals: maintenance activity (how recently and how often the repo is pushed), documentation quality (README completeness, usage examples, API docs), npm ecosystem health (dsh.bundle presence, dependency hygiene), and security posture (install script analysis, known CVEs).
The Gaps Self-Reported Ratings Miss
| Signal | Self-Reported | Independent (DSH) | Why It Matters |
|---|---|---|---|
| Maintenance | Author claims "active" | Last push + commit frequency | Abandoned plugins rot fast |
| Docs quality | Screenshots | README depth + examples | Good docs reduce install errors |
| Security | Nothing | Install script scan | Dangerous scripts get flagged |
| Popularity | Star count | Star count + velocity | Velocity reveals gaming |
Why Maintenance Activity Is the Best Leading Indicator
A plugin that was pushed yesterday is more likely to be maintained tomorrow. Our scoring weights recency and frequency of commits heavily. A plugin with 20,000 stars but no commits in 18 months scores below a 5,000-star plugin with weekly activity — and that ordering has proven more useful for installers in practice.
How We Handle Documentation Quality
We parse each README for required sections: installation, usage, configuration, API reference, and examples. Plugins that skip configuration docs or provide no runnable example lose points. Good documentation is not a luxury — it is a reliability signal that predicts fewer support issues and safer installs.
Security Posture: The Signal Self-Report Can Never Fake
An author can claim anything about their own plugin. They cannot hide a postinstall hook that fetches remote code, because our scanner reads the package.json and install scripts directly. Security is the one dimension where independent scoring is not just better — it is the only reliable option.
The Takeaway
- Ignore star count as the primary ranking signal
- Check maintenance activity before installing anything
- Prefer plugins with complete documentation
- Trust security grades over marketing claims
- Bookmark DSH Quality and re-check before each install