Subscribe to the State of Supply Chain
VCRI's quarterly report on open-source dependency health, abandonment, and compromise. Free under non-commercial license. The data and methodology are public.
📬 Subscribe
One email per quarterly issue. No spam, no upsell. You will get a confirmation email first, and every email has an unsubscribe link.
What you'll receive
- Quarterly issue announcement with a direct link to the report PDF, the data CSV, and the underlying query code.
- Mid-quarter methodology notes when meaningful refinements land (occasional, not monthly).
- Early access to the Q4 issue ahead of public publication.
What you won't receive
- Marketing emails. We don't do them.
- Third-party sharing of your address. It is held only by VCRI and our mailing service, Buttondown, and never sold or shared.
- Sales pitches.
About the report
The State of Supply Chain (SCSC) is VCRI's outside-in measurement of open-source dependency health across eight major ecosystems. Each issue intersects maintenance state (is anyone home to patch?) with historical compromise (has this package been here before?) to produce a procurement-grade watch list. The methodology is rule-based, transparent, and criticizable; the data is published alongside each issue under CC BY-NC 4.0.
Read the inaugural companion piece, Three Eras of Zero-Day Economics, for the structural argument the Q2 issue is built on.
Prefer email? Write to info@valuechainrisk.org and we will add you.