Maven Central / Scarf download statistics appear to be significantly distorted by Checkmarx and possibly other bot scan traffic. These are TestBalloon stats where Checkmarx is leading the pack and two Mozilla UA strings seem suspicious:
👍🏼 1
Oliver.O
06/19/2026, 8:24 PM
And, unfortunately, it seems like bot traffic is not excluded from the other categories like "Total Downloads", ..., "Events by Origin Country", "Downloads by Version".
Oliver.O
06/19/2026, 8:43 PM
The maximum Scarf would reveal is the top 50 user agents, whose aggregated download numbers make up 84% of the total downloads. Within that top 50, 14% of the downloads seem to be scan-related.