Withdrawal notice
Published 6 August 2026. Reference 2026-08-registry-scan-corpus.
Every scan result the OpenA2A registry published between 27 February 2026 15:42 UTC and 16 April 2026 08:05 UTC is withdrawn.
That is 346,366 results covering 315,689 packages. 29,233 of them asserted at least one critical security finding, across 28,186 distinct packages. The largest single claim was 1,714 critical findings against one package.
Those scans did not measure the packages they were published against. They should not have been published, and no reader should treat them as a statement about any package.
If you maintain a package that carries one of these results, nothing about your package produced it. The section on checking your own package below shows how to confirm that from your own repository, without taking our word for any part of it.
The scan cloned each package's source repository and scanned the whole repository. The result was then recorded against one published package inside it.
Where a repository holds exactly one publishable unit, that distinction changes nothing. Where it holds many, it changes everything. A repository of agent skills, a monorepo of npm packages, a template repository: findings from other people's code, from test fixtures, from example directories and from CI configuration were attributed to one named package, then served as that package's finding count, which reads as a claim about a release.
The size of a package's number was largely a function of how many other units happened to share its repository. It was not a function of the package.
One package was recorded with 375 critical findings. Its repository held 305 separate agent skill definitions, each of which the registry had turned into its own package. Another was recorded with 352, from a repository holding 65. In a third case a package published out of a large shared monorepo was recorded with 7 critical findings, every one of them raised by a check that reads agent skill definitions. That monorepo contains 7 such definitions, and the package is not one of them.
In the sample re-run described below, packages whose repository held many publishable units were recorded with 1, 7, 81, 125, 317, 352 and 375 critical findings. Packages whose repository was the package itself were recorded with 1, 2, 3 and 14.
On 6 August 2026 the scans were re-run against a deterministic 24-package sample, drawn by a stable hash of the package identifier across both result profiles so that a third party can redraw the same sample. For each package the original repository was cloned, checked out at the commit that was HEAD on the original scan date, and scanned with the scanner version that was current on that date.
| Measure | Result |
|---|---|
| Packages re-scanned | 23 of 24, one repository is no longer public |
| Exact match on critical and high counts | 22 of 23 |
| Exact match on critical count alone | 23 of 23 |
| Sole mismatch | one package logged 3 high findings, reproduced 4 |
The counts come back. These were not invented numbers, and every maintainer can check the arithmetic against their own repository. That is worth stating plainly, and it does not make the results correct.
A number that reproduces exactly is still wrong when it describes something other than what it is published against. The bar for publishing a security finding about a package is that the finding is about the package. That bar was never met here. This is not a recalibration of scores and not an improvement in methodology. The results did not measure what their publication claimed they measured, from the first entry to the last.
Every affected entry is public and reachable without an account. Find your package by name, then read its transparency log.
curl -s "https://api.oa2a.org/api/v1/registry/packages/by-name/skill/YOUR%2FPACKAGE%2FNAME"Take the id from that response and read the entries recorded against it.
curl -s "https://api.oa2a.org/api/v1/registry/packages/<id>/transparency-log"An entry is covered by this withdrawal when its entryType is scan_completed, its entryData.source is registry_scan, and its timestamp falls inside the window at the top of this notice. Every entry matching that description is withdrawn, including the ones reporting zero critical findings: those entries also assert that a named package was scanned, and it was not. Its repository was.
To check the arithmetic rather than the attribution, clone the repository, check out the commit that was HEAD on the entry's timestamp, and scan it with the scanner version that was current on that date. The findings will be there, in the repository, distributed across files that in most cases belong to no single published package.
The transparency log is hash chained and Merkle committed, and it publishes inclusion proofs by index. Entries in it cannot be edited or deleted without breaking every proof already issued, and removing them from what the API serves would be worse: a reader could then obtain a valid inclusion proof for an index the log reports as absent. Corrections are appended and attached, never applied in place. Nothing described here deletes or rewrites a single entry.
This section is a status list rather than a summary, and it is dated. If a line says it is not finished, it is not finished.
| Change | Status |
|---|---|
| No further result of this kind has been produced. The last affected entry was written on 16 April 2026, and the batch scan that produced them has not run since. | Verified 6 August 2026 |
| This notice, so that the claim cannot be read without the retraction. | Published 6 August 2026 |
| Every affected entry served with this withdrawal attached, on every API path that serves the log. The entry itself is untouched and every existing inclusion proof still verifies. | In progress |
| The withdrawal appended to the transparency log as its own entry, so the correction is exactly as verifiable as the claim was. | In progress |
| The scanning pipeline changed so that it cannot record a repository-wide result against a single package inside that repository. | In progress |
If a result recorded against your package caused a problem that this notice does not resolve, write to info@opena2a.org with the package name. If you would like the withdrawal referenced from somewhere specific, say where.
The measurement behind this notice, including the sample harness and its raw results, is available on request.