Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
semgrep has no daily download counts (PyPI, npm or crates.io).