# SCSC Q3 2026 — Open Data

Data deliverables for *State of the Supply Chain Security — Q3 2026: "Abandoned Is a Range: Bounding the Supply-Chain Maintenance Gap"* (Value Chain Risk Institute).

**Snapshot dates.** Package corpus: ecosyste.ms bulk dump `packages-2026-02-05` (13,108,568 packages, 89 registries). Compromise history: OSV.dev complete mirror, 2026-07-17. Named watch-list packages re-verified against the live ecosyste.ms API on 2026-07-17. Maintainer turnover: diff of ecosyste.ms dumps `packages-2024-06-04` → `packages-2026-02-05`.

## Files

| File | Contents |
|---|---|
| `maintenance-bands.csv` | Per-registry out-of-band maintenance under **both** classification rules. `rw_upper_release_only_pct` = release-recency rule (upper bound); `rw_lower_confirmed_pct` = release-and-commit rule (lower bound); `rw_high_confirmed_plus_unverified_pct` adds packages with no linked repository (no commit signal to check). The report's headline band is [lower, upper]. All `rw_*` percentages are risk-weighted by `dependent_repos_count`, not package count (report §2.4). |
| `watch-list.csv` | Top-15 packages per report ecosystem that are both out-of-band **and** carry OSV advisory history, ranked by dependent repositories. Joined with hand-verification evidence (report §2.6: `hand_verified=yes` rows were checked against their actual OSV records) and July 2026 re-verification status. |
| `oob-top2000.csv` | Full top-2,000 out-of-band packages per registry (release-and-commit rule), all registries — the long tail behind the watch list. Machine-classified, **not** hand-verified below the watch-list top-10 (report §6). |
| `malware-flood.csv` | Per-ecosystem OSV advisory counts vs. malicious-package-report counts (report §4). Aggregate counts only — see caveat below. |
| `turnover.csv` | Maintainer-set changes per registry, June 2024 → February 2026 (report §4.1). |
| `watch-list-refresh-2026-07.csv` | Live ecosyste.ms API re-check (2026-07-17) of the top-15 named packages per registry: current dependents, last release, last commit, still-out-of-band status. Rows with `still_oob=ERR` could not be re-queried. |

## Caveats (read before citing)

1. **The abandonment number is a band, not a point.** The rate for a given ecosystem moves 2–3× depending on the classification rule (report §2.3). Cite the band.
2. **No per-package "malicious" claims.** OSV `MAL-*` records can be name collisions: a typosquat's malware report attaches to a legitimate package's name. Example in this data: `fsevents` carries `MAL-2023-462` in `sample_advisory_ids` — that record refers to a typosquat reusing the name, **not** to the legitimate fsevents package (report §2.6). Malware findings are therefore published only as aggregate counts (`malware-flood.csv`).
3. **Monorepo attribution.** Repository-level commit activity over-rescues dead sub-packages in monorepo ecosystems (Maven, Go); the lower bound is a genuine floor (report §2.3).
4. **Compromise = history.** OSV advisory presence means "has ever had a security event," not "current version is vulnerable."

## Attribution & license

Data derived from [ecosyste.ms](https://ecosyste.ms) and [OSV.dev](https://osv.dev), whose open data makes this work possible.

- **This dataset (`data/2026-Q3/`): CC BY-SA 4.0.** ecosyste.ms source data is CC BY-SA 4.0; the share-alike condition carries into these derived files. Attribute "Value Chain Risk Institute, derived from ecosyste.ms and OSV.dev data."
- The repository's top-level [CC BY 4.0 license](../../LICENSE) applies to VCRI-authored methodology documents; this data directory is the exception, as noted above.

Corrections: open an issue in this repository under the `correction` label.

## Raw evidence files (website mirror only)

This website mirror additionally carries the raw pipeline JSON the CSVs were derived from: `q3-maintenance-v2.json` and `q3-maintenance-summary.json` (per-registry classification under each rule), `q3-intersection.json` (OSV intersection summary), `q3-oob-watch-v2.json` (full out-of-band watch set), `q3-refresh-july.json` (July 2026 live-API re-verification), and `q3-verify-evidence.json` (the hand-verification record, including the fsevents name-collision documented in report §2.6). Canonical CSV home: [github.com/value-chain-risk-institute/state-of-supply-chain](https://github.com/value-chain-risk-institute/state-of-supply-chain).