Ranks packages with disclosed advisories, silent maintainers, and many dependents as orphan-patch candidates, deterministically, from public inputs alone.