No dispute has been upheld to date.
Read that with care. Nobody has yet reported a verdict of ours as wrong and been proven right.
That is not a claim that our verdicts have all been correct, so please do not read it that way. We are a young
service, no detection is perfect, and a clear result can be wrong. We could not prove a clean record
even if we had one, so we do not claim one. The entries below are mistakes we found ourselves.
2026-11-04: We marked packages and servers as malicious because they named a public CDN.
What happened. Threat feeds we use, abuse.ch ThreatFox and URLhaus, list malware on public CDNs. We matched those listings by host name alone. So any code or text we scanned that named cdn.jsdelivr.net, fastly.jsdelivr.net, cdn.statically.io or rawcdn.githack.com came back as malicious, risk critical, high confidence. That was wrong. It said nothing about the code that named them. It reached at least one real package and an MCP server on our public pages.
Since when. The earliest listing we know of is dated 2026-08-13, so it may go back that far. We cannot place it more exactly.
What we fixed. These hosts no longer count as a match, under rules 2026.11.04a. Package pages, cached results and the MCP registry index re-evaluate under the new rules. A stored malicious verdict from before then is withdrawn unless its content hash or a published advisory confirms it. A test now fails if any host on our shared list can match.
What we cannot recall. A signed attestation already handed out stays validly signed, and checking it offline will not show the withdrawal. POST /v1/verify will. We did not record which past verdicts came from this match, so we cannot list them or say how many there were.
If this affected you, write to contact@lazaretto.dev.
How to dispute a verdict
Do you publish an artifact and think our malicious or flagged verdict is wrong?
Email contact@lazaretto.dev with the package or hash. Here is what we commit to.
The Terms refer to it:
- A human decision on a disputed
maliciousverdict within three business days. - An upheld dispute removes or annotates the indicator and invalidates the cached verdict for that hash immediately.
- It is listed on this page, with the cause.
What we already publish about our limits
Corrections are the last line. We also say up front when a verdict is weaker than it looks.
A scan that could not read part of an artifact says so. A known-bad check that could not run reports
null, not "no match". An unpinned package with a version-scoped advisory returns "cannot determine",
not a guess. See where our data comes from
and the disclaimer.
We also publish how often we flag a package that turns out to be fine. We measure it on lists we publish in full, and we list each attack sample we miss. See the benchmark page. This log holds the mistakes someone reported to us and any we found ourselves in verdicts we published. The benchmark measures our rules on those lists.
Machine-readable: /corrections.json