Weekly flagged-first digest · 2026-W35
Flagged-first week 2026-W35: 216 malicious packages caught
PkgRadar caught 216 malicious packages this week across 2 ecosystems, a median 1 day before the public advisory. 51% were flagged first.
This week
- 216flagged this week, out of 420 scanned
- 51%flagged before public disclosure
- 1dmedian lead time ahead of the advisory
- 158604flagged all-time
Pattern of the week
The most common tell across this week’s catches: js obfuscator packer (6458 packages).
Caught before the advisory
- 48d earlynpm · mapkit-loader@1.0.0MAL-2026-14218
- 31d earlynpm · sysc1@1.0.0MAL-2026-14214
- 29d earlynpm · ssb-test-package@1.0.0MAL-2026-14221
- 27d earlynpm · sysc1@1.0.1MAL-2026-14214
- 26d earlynpm · ambera@1.0.0MAL-2026-14225