Q2 2026 SCSC — Dependency Risk List
The categorized dependency-risk data behind the Q2 2026 State of Supply Chain report. Three tiers below. Free for non-commercial use under Creative Commons BY-NC 4.0; commercial licensing available via VCRI. Methodology: see report §2 and Appendix A. Full report at /state-of-supply-chain/2026-Q2/.
—
Critical — out-of-band × previously-compromised
—
Concerns — out-of-band (sample of top-30 per ecosystem)
—
Watch — slowing (sample of top-20 per ecosystem)
Critical tier: packages that are BOTH out-of-band (abandoned, archived, deprecated, or formally superseded) AND have historical compromise evidence in OSV.dev. This is the highest-priority watch list — when the next CVE drops, there is no active maintainer to ship the fix. Procurement implication: rotate, sandbox, or accept-and-monitor with leading-clock signals wired (per §5.1 of the report).
| Ecosystem | Package | Status | Dependents | Vulns | Notes |
|---|
Concerns tier: packages classified as out-of-band (abandoned, archived, deprecated, or superseded) without (yet) being cross-referenced against OSV.dev compromise history. Top 30 per ecosystem by dependent count, sample of the full corpus. For procurement decisions on a specific dependency, check both this tier and the Critical tier. Full corpus is in the published data repository.
| Ecosystem | Package | Status | Dependents | Days since release | Archived? |
|---|
Watch tier: packages classified as Slowing — trailing both the Active and Stable thresholds but not yet abandoned. Many mature packages live here legitimately; a fraction are on a glide path to Dormant or Abandoned. Procurement implication: monitor; consider engagement with maintainers if mission-critical. Top 20 per ecosystem by dependent count.
| Ecosystem | Package | Dependents | Days since release | Archived? |
|---|
Generated . Source: ecosyste.ms (registry metadata) + OSV.dev (compromise history) + Clearwing pipeline classification. Q3 2026 expansion will include npm at full top-10K rigor (via deps.dev BigQuery) and quarter-over-quarter delta analysis. This Q2 issue is the inaugural snapshot.