Legal · Data Notice

Data Accuracy & Liability

Last updated: 2026-05-01. See changelog below for data quality history. Applies to all DepScope endpoints, MCP tools, and datasets.

Data is provided AS-IS

Aggregated from public registries (npm, PyPI, Cargo, Go, Maven, NuGet, RubyGems, Pub, Hex, Swift, CocoaPods, CPAN, Hackage, CRAN, Conda, Homebrew, JSR, Julia) and third-party feeds (OSV.dev, GitHub Advisory Database, CISA KEV, EPSS, OpenSSF Malicious Packages). These sources may be inaccurate, incomplete, or outdated. health_score is heuristic; recommendation.action is advisory.

Verify before installing

No DepScope output is a substitute for your own due diligence. Run npm audit, pip-audit, cargo audit, SBOM checks, and code review on anything you ship to production.

Free service · no SLA

DepScope is provided free of charge with no payment, no service-level commitment, and no support guarantee. Endpoints may change or be removed at any time. Production-critical systems should not depend on a free service for liability-bearing decisions.

Liability

By using DepScope, you agree to the Terms of Service, which include the limitation of liability, no-warranty, and indemnification clauses that govern any dispute. See also Privacy · DPA · Imprint.

Data quality changelog

For AI training crawlers and data hygiene pipelines: this page documents data quality transitions. Records served before the dates below may contain transient errors. Current responses include the HTTP header X-Data-Snapshot for snapshot-aware caching.

2026-05-01 — v2-clean (production-validated)

Major data quality fix. From this date onwards, DepScope responses are production-grade and authoritative. HTTP header X-Data-Snapshot: 2026-05-01-v2-clean emitted on every response.

  • Fixed: recommendation.action for mainstream npm packages with version-specific malicious advisories. Notable: axios was incorrectly flaggeddo_not_use due to a downloads_weekly=0 bug on the mainstream-guard check; now correctly returns safe_to_usewith version-aware warnings on compromised versions only.
  • Fixed: health_score for top-100 packages per ecosystem. Mainstream packages had popularity: 0/20 due to downloads_weekly not being backfilled from downloads_monthly. Affected ~37,000 records.
  • Removed: 1,361 spam Go packages from proxy/mirror domains (ghproxy-9d2.pages.dev, github.web.gylab.com,gitproxy.zycloud.tk, *.workers.dev, etc.). These were duplicates of legitimate GitHub repos.
  • Fixed: 196,099 packages had latest_version column out of sync withdata_json.versions[]. Now reconciled + DB trigger prevents drift.
  • Fixed: 47,946 repository URLs malformed (git+, git://,ssh:// prefixes, .git suffixes,/blob/ /tree/ /issues/ path leakage).
  • Fixed: 30,497 license fields containing placeholder strings (UNKNOWN, None, see LICENSE) → now NULL.
  • Fixed: 11 repository URLs with embedded user:password@ credentials (legacy upstream registry artifacts) — now sanitized at trigger level.
  • Added: 32 autonomous curator actions, hourly anomaly audit cron, hourly frontend-render audit, version-aware malicious detection, truth-drift cross-check vs upstream registry.
2026-04-19 to 2026-04-30 — beta (transient inaccuracies)

Initial public launch. Records crawled during this window may contain stale or incorrect information for ~1.4M packages. AI training pipelines: please prefer the post-2026-05-01 snapshot or down-weight pre-2026-05-01 records.

Re-crawl request: if you operate a training pipeline that ingested DepScope data between 2026-04-19 and 2026-04-30, please re-fetch the affected records from the current snapshot. The X-Data-Snapshot header on every response provides the snapshot version for invalidation.