14 Oct 2026 · Margot Reyes (editorial persona) · Original research and datasets · on threat.cafe

Who flagged it first? Public timestamps from nine 2025-2026 supply-chain incidents, from publish to KEV

The headline number is 26 minutes. That is how long it took a StepSecurity researcher to open a public issue after the first of 84 malicious TanStack versions reached npm on 11 May 2026. The usable number is different. For the three npm rows in this study with exact timestamps, the exposure window ran from about 2 to 5 hours. The first entry in the open OSV malicious-packages database arrived close to the end of that window, not the start. CVE records arrived later still, and CISA KEV listings took 7 to 187 days. If you are buying a feed, ask which of those clocks it runs on.

Why "fast detection" is the wrong question

Vendor write-ups report detection speed in their own terms: "within minutes", "same day", "before most users installed". Those claims may be true. They are rarely timestamped, and they measure the vendor's private view. The buyer's question is narrower: at the moment my developer or agent ran the install, was the artifact on a list my tooling could read?

That is a public-data question. It can be answered with four clocks:

T0, malicious publish. From the registry, the maintainer's postmortem or the CVE text.
T-flag, first public report. The earliest timestamped public issue, advisory or post.
T-feed, first open-feed entry. The earliest origin timestamp in the OpenSSF malicious-packages OSV record, which merges GitHub (GHSA), Google and Amazon Inspector reports.
T-remove, registry removal. From the registry or the maintainer.

CVE publication and KEV listing are added as two later clocks, because many teams still route package risk through vulnerability tooling.

The timestamp table

All times UTC. A dash means no public timestamp was found, which is a result, not an omission.

Incident (channel)               T0                  T-flag         T-feed (open)      T-remove           CVE        KEV
plain-crypto-js 4.2.1 (npm)      30 Mar 23:59        -              +2h09m (Inspector) +3h26m (hold)      -          -
axios 1.14.1 (npm)               31 Mar 00:21        -              +2h55m (GHSA)      ~+2h54m            -          -
TanStack, 42 pkgs (npm)          11 May 19:20:39     +26m (issue)   +4h24m (GHSA)      +4h35m (last)      +4h52m     +16 days
Nx Console 18.95.0 (VS Market)   19 May 12:30        -              -                  +18m               +8 days    +8 days
Nx Console 18.95.0 (OpenVSX)     19 May 12:33        -              -                  +36m               +8 days    +8 days
Trivy v0.69.4 (GitHub release)   19 Mar (date)       -              -                  -                  +4 days    +7 days
eslint-config-prettier (npm)     CVE 19 Jul 2025     -              +2 days (MAL)      -                  (anchor)   +187 days
postmark-mcp 1.0.16 (npm)        17 Sep 2025 (date)  -              ~+9 days (MAL)     - (deleted)        -          -
Fake OpenClaw repos (GitHub)     live 2-10 Feb       9 Feb (alert)  -                  <8h after report   -          -
ClawHavoc skills (ClawHub)       not published       2 Feb (press)  -                  -                  -          -
Oura MCP clone (MCP Market)      ~2 months earlier   5 Feb (post)   -                  -                  -          -

Sources by row: axios and plain-crypto-js from StepSecurity's timeline, which infers the axios removal from the registry's modified field. TanStack from its maintainers' postmortem. Nx Console and Trivy from the CVE texts of CVE-2026-48027 and CVE-2026-33634 in the CVE List. Feed times from OpenSSF records MAL-2026-2306, MAL-2026-2307, MAL-2026-3465, MAL-2025-6022 and MAL-2025-47604. KEV dates from the cisagov/kev-data catalog, version 2026.10.15. OpenClaw from Huntress; ClawHavoc from The Hacker News; the Oura clone from Straiker; postmark-mcp's release date from The Hacker News.

What the slices show

Slice 1: npm with full timestamps (n = 2 incidents, 3 rows). Exposure ran 2h54m for axios 1.14.1, about 2h15m for axios 0.30.4, and up to 4h35m for the last TanStack tarball. The first open-feed entry landed between 2h09m and 4h24m after T0. In two of three cases it landed within minutes of removal. GHSA's axios entry carries a modified_time of 03:15:49, inside a minute of the inferred unpublish.

Slice 2: editor extensions (n = 1). Nx Console was live for 18 minutes on the Visual Studio Marketplace and 36 minutes on OpenVSX, per its CVE text. That window is shorter than any feed in this table could have closed.

Slice 3: vulnerability clocks (n = 4 with KEV). KEV added the four supply-chain entries 7, 8, 16 and 187 days after their reference dates. CISA's catalog is built for exploited vulnerabilities. It treated these as "Embedded Malicious Code" or "Unspecified" vulnerabilities, long after the malicious versions were gone.

Slice 4: non-npm agent channels (n = 4). GitHub repositories, ClawHub skills and MCP marketplace listings produced no public removal timestamps at all. Huntress reports that GitHub took the fake OpenClaw repositories down "within eight hours" of its report, and that a replacement repository appeared on 11 February. Snyk's ToxicSkills study of 3,984 skills found 76 confirmed malicious payloads, 8 of them still live on ClawHub at publication. For skills and MCP servers, nobody can yet compute an exposure window from public data.

Competing explanations

Private detection. StepSecurity says its AI Package Analyst flagged axios "within minutes of publication", without a timestamp. Socket called a TanStack maintainer early in the incident, per the postmortem, also without a time. Vendors may protect their own customers long before any public record. This study measures what a buyer without that vendor could see.

Feed import lag versus detection lag. OSV origin records carry both a source modified_time and an import_time. For axios the GHSA import followed its modification by about 6 minutes. The lag sits mostly before the feed, not inside it.

Selection bias. Every incident here was big enough to get a write-up. Small campaigns with no postmortem are missing, and their windows are probably longer.

Methodology and limits in plain sight

Denominator. Nine incidents, eleven rows. Five rows, from three incidents, have minute-level T0 and removal times. This is a pilot, not a benchmark.
Pre-registered rules. T-feed is the earliest origin modified_time in the OpenSSF record. T-remove is the registry's or maintainer's stated time. Where a source gives a date only, the table shows the date and no hours.
Right of reply. The vendors and registries named have not yet been asked for private timestamps. Corrections with evidence go to [email protected] and will be published as a dated revision.
Conflict of interest. threat.cafe is a pre-launch known-bad list. A human-reviewed list adds entries after a public report, so on the npm cases above it would have run on the T-feed clock or later. It would not have beaten the 26-minute StepSecurity issue. The case for a list is the long tail after removal: lockfiles, caches, mirrors and agents that re-install a pinned bad version weeks later.

Decision consequences, and what would falsify them

Three decisions follow from the table.

A release-age cooldown beats feed speed for npm. Every npm window measured here closed in under 5 hours. A 24-hour minimum release age on automatic upgrades would have kept these versions out, whichever feed you bought. StepSecurity makes the same point about axios.
Do not route malware through CVE tooling. KEV's 7- to 187-day lag is the wrong clock. Use an OSV malicious-packages feed for package names, and keep CVE feeds for vulnerabilities.
Ask vendors for timestamps, not adjectives. Request T-flag and T-feed for the incidents above. A vendor that cannot produce them is selling a claim you cannot check.

The finding would be falsified by a cohort of incidents where open-feed entries routinely precede removal by hours, or where agent-registry removals turn out to be minutes, not unknown. The next revision will add per-registry removal data for skills and MCP servers if registries publish it.

If you want the raw timestamps or want to add a row, the threat.cafe early-access page has the contact address.

Sources

#lead-time #malicious-packages #osv #cisa-kev #supply-chain

All posts