Snapshot 2026-10-26
How we count release outcomes
We query public npm, PyPI and crates.io registry histories, take stable releases from the preceding 365 days and keep the 200 most-updated packages from a curated candidate pool. This is not a registry-wide top 200. The snapshot window is October 26, 2025 through October 26, 2026.
- releases_12m
- Stable releases published in the snapshot’s last 365 days.
- pulled
- Releases yanked on PyPI or crates.io, or deprecated with a reason on npm. Package-wide deprecations and stated end-of-life notices are excluded for npm.
- pulled_security
- Pulled releases whose stated reason mentions a vulnerability or compromise. This is maintainer text, not independent detection.
- fixed_within_72h
- Releases replaced by a higher patch on the same major.minor line within 72 hours AND within one quarter of the package’s median release interval. A timing proxy, not proof of a defect.
- pulled_or_fixed
- The union of pulled and quickly fixed releases. A release that meets both definitions is counted once.
- share_pulled_or_fixed
- The union divided by stable releases. Omitted when there are fewer than six releases. Displayed shares use the counts rather than the rounded CSV ratio.
- removed_npm
- Unpublished; the registry does not say why. These are not included in pulled counts.
- median_days_between_releases
- Median interval between distinct release timestamps in the window. Simultaneously published version lines count as one event.
- latest_stable / latest_published
- Most recently published stable release and its publication date in the window.
- recent_pulled_or_fixed
- Up to five recent versions that meet either outcome definition, most recent first. The CSV does not identify which definition each version met.
- example_pulled_reason
- One package-level example from registry maintainer text, truncated to 90 characters. It is not mapped to the displayed recent versions.
- page_path
- The package URL, including its ecosystem so identical names remain distinct.
What this table does not show
It records what maintainers did after a release. It does not detect compromised or malicious releases; those are often removed from the registry entirely and appear here at most as unexplained removals. For security, use a dedicated supply-chain scanner.
A quick patch does not establish why it was published. The data does not measure downstream breakage, reverts or pins in your repository. A cooldown describes which versions would have been superseded before becoming eligible, not a promise that a release is safe.