Weekly flagged-first digest · 2026-W36
Flagged-first week 2026-W36: 69 malicious packages caught
PkgRadar caught 69 malicious packages this week across 2 ecosystems, a median 0 days before the public advisory. 11% were flagged first.
This week
- 69flagged this week, out of 596 scanned
- 11%flagged before public disclosure
- 0dmedian lead time ahead of the advisory
- 255053flagged all-time
Pattern of the week
The most common tell across this week’s catches: new lifecycle script vs previous (4449 packages).
Caught before the advisory
- 39d earlynpm · @fleetbo/svro@0.0.5MAL-2026-14586
- 39d earlynpm · @fleetbo/svro@0.0.6MAL-2026-14586
- 38d earlynpm · @fleetbo/svro@0.0.9MAL-2026-14586
- 38d earlynpm · @fleetbo/svro@0.0.10MAL-2026-14586
- 33d earlynpm · @fleetbo/svro@0.0.24MAL-2026-14586