Calibration · archived run
How well does pkgxray call it?
An at-scale, code-only static scan of published packages, measured against a committed known-malware corpus. Four numbers, adjudicated by hand, reproducible from the inputs below.
Methodology & how to reproduce → · Raw JSON · Target lists
Aggregate calibration of a one-time at-scale static scan. Catch rate is measured against the committed reconstructed known-malware corpus (npm removes live malware, so live recall is untestable). The one top-1000 false block is the as-measured figure that drove the retune; the full scan was not re-run on the fixed engine. See methodology.
Corrections
Published runs are immutable. If a number is wrong we publish a new dated run and note it here — we never silently edit a number in place. Contest a figure at the tracker.
- 2026-07-19 — Full 1,000-package scan re-run on the retuned engine; the single pre-retune heuristic false block now resolves to review, with no new false block. (superseded by 2026-07-19-retuned)
Run history
Every published run stays up at a stable URL.
Pinned version: this page is the 2026-07-19 snapshot at
pkgxray 1.0.3 · 250a3b3.
Latest run →