Tag
#osv
5 posts
-
Who flagged it first? Public timestamps from nine 2025-2026 supply-chain incidents, from publish to KEV
Where public timestamps exist, malicious npm releases were flagged within minutes and pulled within about 3 to 5 hours. Open malware feeds caught up near removal time. CVEs and KEV listings came days to six months later.
-
Is OSV enough for agent artifacts? Measuring how many malicious MCP servers and skills appear in open malicious-package data
Of 10 documented agent-ecosystem incidents, 6 appear in the OpenSSF malicious-packages data. All 6 shipped through npm. None of the skill-store or GitHub-hosted incidents do, because OSV has no identifier for them.
-
Malicious packages are not vulnerabilities: why your CVE scanner can pass a package that is malware by design
Malware gets a malware advisory, not a CVE, and lives in separate datasets. In our 15 October test, npm audit flagged three of four known-malicious versions; the fourth is listed in OSV but not in GitHub's database.
-
Known bad, no known bad, unknown: a three-state policy model for agent artifacts
Most agent artifacts have never been checked by anyone. Splitting verdicts into known bad, checked with nothing found, and never checked lets policy block, log or ask a person without calling unreviewed code safe.
-
After NVD's triage: what a 2026 CVE record still carries, and how small teams rebuild triage for free
In a sample of 890 CVE records published in 2026, 96% carried a CVSS score from the CNA or CISA, but under 10% carried a CPE string. Severity mostly survived NVD's triage. Product matching did not. Here is the free rebuild.
