What the numbers mean
Definitions and units. Nothing here describes how a package gets flagged.
Counts
- screened: package versions Protet looked at. Counted per UTC day as distinct package versions; a version screened on two different days counts on both days (a version-day).
- flagged: distinct package versions Protet marked as suspicious. A version flagged on two days counts once. The “last 7 days” figure counts version-days, like screened.
- flag rate: flagged divided by screened.
- confirmed: package versions a Protet reviewer confirmed as malicious (unit: package versions).
- false positives: flagged package versions a reviewer judged not malicious (unit: package versions).
- BTP / legitimate-publisher: behaviour that matches malware patterns from a publisher we assess as legitimate, for example security tooling. Counted on its own. It is not a false positive, is left out of precision and of the false positive rate, and is never reported to OSV.
- missed (found later): malicious package versions that were not flagged when screened and were found afterwards.
- in review: flagged package versions without a final verdict yet.
confirmed + BTP + false positives + in review = flagged.
Rates
- precision = confirmed / (confirmed + false positives).
- false positive rate = false positives (package versions) / screened (version-days). While some flagged versions are still in review the figure is a lower bound, and the tile says so.
Periods
Totals cover every complete UTC day with screening data, including today so far. “Last 7 days” covers the 7 most recent complete UTC days before today and shows screened, flagged and flag rate only. Review results carry no date, so confirmed, false positives, BTP, missed and in review are all-time numbers.
Who is named
Only package versions a reviewer confirmed as malicious, or marked BTP, are named. Everything else appears only inside the totals above. Ecosystem: npm only; every address carries it.
Withdrawals
A published entry is never removed. If a reviewer later changes a verdict, the entry is shown as withdrawn, or as reclassified between confirmed and BTP, with the date of the change. A withdrawn or reclassified confirmed entry has its OSV record marked withdrawn.
Formats
NDJSON and Atom for every named entry and for npm, one OSV (schema 1.6) record per confirmed package version, and a stats file. Files are rebuilt every 10 minutes and cached for 5 minutes.