Issue 2 · Q3 2026 · Released at DEF CON, Las Vegas

Abandoned Is a Range Bounding the Supply-Chain Maintenance Gap

Read the report → Download PDF Data CSVs + JSON

"A report that only survives if you don't check its work is not research."

From the methodology section of this issue

We classified 13.1 million packages. The abandonment number everyone quotes as a single percentage is really a range, and its width is the finding. Depending on how you define "still maintained" (release activity alone, or release and repository-commit activity), the risk-weighted out-of-band rate for a given ecosystem moves by a factor of two to three. Maven reads 8% or 34% under equally defensible definitions. npm reads 36% or 52%. That is not noise in the data; it is a judgment the data underdetermines. The honest unit for this measurement is a band, not a number. Any supply-chain report that quotes a single abandonment percentage, including our own Q2, is quoting one end of a range and calling it the middle.

13.1M

packages classified: the entire published corpus, not a top-N sample

ecosystems reported, each as a band between two defensible rules

2–3×

how far the headline number moves between equally defensible definitions

false memberships in the hand-verified watch list (top 10, every ecosystem)

What's in this issue

The abandonment band, by ecosystem: risk-weighted out-of-band percentage as an honest lower/upper bound, full 13.1M-package corpus
The verified watch list: load-bearing packages that are both out-of-band and carry real, version-ranged advisory history: log4j:log4j, pycrypto, commons-collections, swiftmailer, jwt-go, uri-js, and their kin. Hand-checked against OSV; re-verified against the live API in July 2026
Three artifacts we caught before you did: a takeover signal that dissolved into benign churn, an inflated npm number from miscounted stable-complete micro-packages, and a "malicious" flag that was a typosquat name collision. Documented, not buried
Why full-corpus barely moves the numbers: risk-weighting makes the method robust to corpus size; the classification rule is what matters
What we could not do: a clean quarter-over-quarter trend. The method had to stabilize first; Q4 is the first true delta
All data published: band table, watch list, top-2000 out-of-band per registry, and the raw verification evidence, under CC BY-SA 4.0 (share-alike inherited from ecosyste.ms source data), also mirrored on GitHub

Next issue: Q4 2026, the first true delta

Q3 establishes the stable method; Q4 measures the first real quarter-over-quarter movement. Subscribe to get a single email when it ships, plus any corrections to this issue.

Subscribe to the newsletter →

Previous issues

Q2 2026: Two Clocks · Abandonment, Compromise, and the Window Between Them. The inaugural issue: the 11-day advisory gap, the out-of-band framing, and the first intersection list.

Authored by Joshua Marpet (VCRI founder/president) and Cairn Viktor (digital researcher, VCRI). Quarterly cadence. Q4 2026 issue targeted for early November.