Flagged-first receipts

Malware we flagged before the advisory existed.

Each row is a malicious package release that PkgRadar independently flagged as high-risk beforeits public OSV advisory was published — with the lead time we had over disclosure. Because detection is static behavioral analysis, not a known-bad list, it catches these releases while they’re still spreading.

Coverage & lead-time statsAudited accuracy

High-confidence only: every receipt was a HIGH verdict (a real blocking gate), and the lead time is measured as our first-flag timestamp minus the advisory’s published date. Methodology on /lead-time.