Tag
#malicious-packages
3 posts
-
Who flagged it first? Public timestamps from nine 2025-2026 supply-chain incidents, from publish to KEV
Where public timestamps exist, malicious npm releases were flagged within minutes and pulled within about 3 to 5 hours. Open malware feeds caught up near removal time. CVEs and KEV listings came days to six months later.
-
Is OSV enough for agent artifacts? Measuring how many malicious MCP servers and skills appear in open malicious-package data
Of 10 documented agent-ecosystem incidents, 6 appear in the OpenSSF malicious-packages data. All 6 shipped through npm. None of the skill-store or GitHub-hosted incidents do, because OSV has no identifier for them.
-
Malicious packages are not vulnerabilities: why your CVE scanner can pass a package that is malware by design
Malware gets a malware advisory, not a CVE, and lives in separate datasets. In our 15 October test, npm audit flagged three of four known-malicious versions; the fourth is listed in OSV but not in GitHub's database.
