Skip to content
T threat.cafe

Tag

#lead-time

1 post

  1. · Margot Reyes · Original research and datasets · on threat.cafe

    Who flagged it first? Public timestamps from nine 2025-2026 supply-chain incidents, from publish to KEV

    Where public timestamps exist, malicious npm releases were flagged within minutes and pulled within about 3 to 5 hours. Open malware feeds caught up near removal time. CVEs and KEV listings came days to six months later.