Methodology

Best-effort ownership and provenance events from public registry metadata. methodology_version 2026.09.0.

Not a security rating. Not a malware verdict. Ownership events are reconstructions from public registry metadata only.

Poll policy

CI and Workers use recorded registry JSON under fixtures/recorded/ via a fixture client. LiveRegistryClient is blocked when ci: true. Live allow-list poll is owner-gated after soft launch.

Change kinds

first_seen — first snapshot in our archive
owners_changed — maintainer/owner set differed
version_published · yanked · unyanked
republish_suspect — same version, different content digest
fetch_failed — registry fetch error (recorded, not sold as fact)

Extract

Best-effort fields: owners[], versions[], yank flags, digests when present. Extract never blocks raw ingest.

Index

pkgs.ownership_change_rate.seed (marketing alias pkg_owner_transfer_rate) — share of seed packages with ≥1 owners_changed event in the observation window.

Free sample last point (no key): GET https://pkgs-api.idlidu.com/v1/public/sample/index