We considered listing implementations we tested and deemed secure, however this is really hard to do in practice. See also the answer in the second question in the Q&A.

Most libraries have several implementations of the scalar multiplication algorithm, which they choose from dynamically, based on build options, the chosen curve, the platform, the cryptosystem/operation being performed, the current phase of the moon, etc..

We tested the libraries listed here:

https://github.com/crocs-muni/ECTester/blob/master/docs/LIBS...

as we had those implemented and so testing meant just running our tools and analyzing the results. However, even this could have missed stuff, as at first we did miss the Java vulnerability, as we focused on prime field curves and did not test binary field ones. We then analyzed most other cryptographic libraries with ECC support one could think of, but only via source code analysis.

Regarding the stars, we put those in to give some context of why we listed those particular vulnerable implementations on GitHub. We searched through GitHub repositories mentioning ECDSA, ordered by their stars as a measure of popularity and analyzed the source code of their scalar multiplication for the vulnerability. One could choose just random hobby ECDSA implementations and list them as likely vulnerable, these are just a few that are worthy of listing because of their popularity.

Edit: We have added the list of tested implementations deemed secure https://minerva.crocs.fi.muni.cz/#secure-impl.

user:	j08ny
created:	March 1, 2017
karma:	62
about:	[ my public key: https://keybase.io/j08ny; my proof: https://keybase.io/j08ny/sigs/Z5JimAOqaQ42v1UWoZgZFCU4IoggDKZKxVCqLb3LCAI ]

1.	Minerva: Practically exploitable side-channel leakage in ECDSA implementations(minerva.crocs.fi.muni.cz) 85 points by j08ny 6 years ago \| 50 comments
2.	The Theoretical Minimum(theoreticalminimum.com) 2 points by j08ny 8 years ago \| 0 comments