Pilot, November 2026
Counts only. No package names, versions, paths or key values are published.
What we scanned
Section titled “What we scanned”On 5 November 2026 we scanned:
- the 2,000 most recently changed npm packages (their
latestversion), and - the newest release of the 2,000 most recently released PyPI projects (the sdist and the smallest wheel),
leaving out the newest hour of each registry so uploads had settled. How the scan works is in tools/ecoscan/README.md. In short: file lists come from jsDelivr (npm) and from each wheel’s index (PyPI); packages are downloaded only when needed; agent files are found by path; and only those files are checked for strings shaped like API keys. No key is ever used or tested, and every value is redacted when it is found.
Results
Section titled “Results”| npm | PyPI | |
|---|---|---|
| Packages scanned | 1,976 of 2,000 | 1,997 of 2,000 |
| Not scanned | 24 too big (over 64 MB, not listed by jsDelivr) | 3 removed from PyPI |
| Errors | 0 | 0 |
| Ship any agent file | 41 (2.1%) | 184 (9.2%) |
… instruction files only (AGENTS.md, CLAUDE.md, rules) |
26 | 143 |
| … other agent files (settings, MCP config, agent folders) | 15 (0.8%) | 41 (2.1%) |
| Match agentprint’s “should never ship” rules (AP006) | 1 | 6 |
| Key-shaped strings inside agent files | 0 | 0 |
Packages with each kind of file (a package can have several):
| File | npm | PyPI |
|---|---|---|
AGENTS.md |
27 | 129 |
CLAUDE.md |
9 | 88 |
Anything under .claude/ |
7 | 38 |
.mcp.json |
8 | 16 |
.claude/settings.json |
0 | 13 |
.claude/settings.local.json |
1 | 3 |
Anything under .codex/ (3 of them config.toml) |
0 | 8 |
.cursor/ or .cursorrules |
1 | 8 |
GEMINI.md or .gemini/ |
0 | 6 |
On PyPI, 178 of the 184 releases had their agent files in the sdist (37 had them in the wheel; some had both).
Cost: npm 1.36 GB and 21 minutes, PyPI 3.03 GB and 17 minutes, run side by side. jsDelivr’s file lists matched the real tarballs for all 87 npm packages we checked both ways.
What it means (and what it doesn’t)
Section titled “What it means (and what it doesn’t)”- PyPI releases ship agent files about four times as often as npm packages (9.2% against
2.1%), and other agent files about 2.7 times as often (2.1% against 0.8%). A likely reason:
an sdist usually carries the whole project folder, where
.claude/and friends live, while many npm packages publish only a build folder. This sample cannot prove the reason. - Most agent files are instruction files.
AGENTS.md,CLAUDE.mdand rule files are often published on purpose and are not leaks. We count them separately. - Zero keys is not “no problem”. Lakera reported 30 npm packages with credentials in agent files among about 46,500 scanned (about 0.065%). At that rate we would expect about 1.3 such packages in 2,000, and seeing none happens about 28% of the time. With 0 in 3,973 packages, the true rate is likely below about 0.08% (95% upper bound), which still includes Lakera’s rate.
- Our
.claude/settings.local.jsoncount is much lower than Lakera’s (1 in 1,976 npm packages; Lakera: 428 in about 46,500, or 0.9%). Lakera may have chosen packages differently, or publishers may be doing better. One day of new packages cannot tell.
Limits
Section titled “Limits”- Small sample: 2,000 packages per registry, one day, newest packages only.
- npm: only the
latestversion of each package. PyPI: one wheel per release. - Big packages were left out (1.2% of npm packages).
- Detection is by file path and key pattern. Whether a key-shaped string is a real key is decided by hand, without using it; this pilot found none to check.
The next step is a much larger scan run by volunteers, each taking a small shard: the census.