Calibration · latest run

How well does pkgxray call it?

An at-scale, code-only static scan of published packages, measured against a committed known-malware corpus. Four numbers, adjudicated by hand, reproducible from the inputs below.

1,301

packages scanned

published npm + MCP packages, one static pass

0.0%

false blocks, top 1,000

0 of the 1,000 most-downloaded packages

95.0%

known-malware catch rate

19 of 20 corpus samples blocked outright

2026-07-19

run date

pkgxray 1.0.3 · build 1fed962

Methodology & how to reproduce → · Raw JSON · Target lists

Aggregate calibration of the 2026-07-19 at-scale static scan, RE-RUN on the retuned engine. Catch rate is measured against the committed reconstructed known-malware corpus (npm removes live malware, so live recall is untestable). The top-1000 false-block figure is the coherently re-measured count on the fixed engine — see methodology.

Corrections

Published runs are immutable. If a number is wrong we publish a new dated run and note it here — we never silently edit a number in place. Contest a figure at the tracker.

2026-07-19 — Re-scan of the 2026-07-19 calibration campaign on the retuned engine. Supersedes the provisional 2026-07-19 run, whose top-1000 false-block figure was the as-measured pre-retune number pending a re-run. The full 1,000-package scan was re-run on the fixed engine: the single pre-retune heuristic false block now resolves to review, with no new false block, giving 0 / 1,000.

Run history

Every published run stays up at a stable URL.

2026-07-19

Pinned version: this page is the 2026-07-19-retuned snapshot at pkgxray 1.0.3 · 1fed962. Latest run →