#flaggedfirst
LightNews LightNews
pkgradar.bsky.social
⏱ 2 days of lead time on npm eslint-plugin-skywagon-web@100.0.0: we flagged it, then MAL-2026-17215 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm eslint-plugin-skywagon-web@100.0.0
PkgRadar flagged this 2 days before MAL-2026-17215 was published. See the dated receipt and static evidence.
pkgradar.com
September 28, 2026 at 8:24 PM
pkgradar.bsky.social
⏱ We flagged npm cma-self-hosted-sandbox-cf@1.0.0 7 hours before the public advisory landed (MAL-2026-17190).

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm cma-self-hosted-sandbox-cf@1.0.0
PkgRadar flagged this 7 hours before MAL-2026-17190 was published. See the dated receipt and static evidence.
pkgradar.com
September 26, 2026 at 8:23 PM
pkgradar.bsky.social
⏱ Before the advisory: our scan flagged npm better-md@99.0.0 74 days ahead of MAL-2026-16446.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm better-md@99.0.0
PkgRadar flagged this 74 days before MAL-2026-16446 was published. See the dated receipt and static evidence.
pkgradar.com
September 23, 2026 at 8:22 PM
pkgradar.bsky.social
⏱ Before the advisory: our scan flagged npm @tesla-insurance/vinless-quote@9.9.10 5 hours ahead of MAL-2026-16378.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm @tesla-insurance/vinless-quote@9.9.10
PkgRadar flagged this 5 hours before MAL-2026-16378 was published. See the dated receipt and static evidence.
pkgradar.com
September 22, 2026 at 8:21 PM
pkgradar.bsky.social
⏱ Caught early: npm feed-widget-helper@1.0.0 was on our radar 1 day before MAL-2026-16332 went public.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm feed-widget-helper@1.0.0
PkgRadar flagged this 1 day before MAL-2026-16332 was published. See the dated receipt and static evidence.
pkgradar.com
September 21, 2026 at 8:19 PM
pkgradar.bsky.social
⏱ We flagged npm tailwindcss-fluid-styles@2.0.7 10 hours before the public advisory landed (MAL-2026-15826).

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm tailwindcss-fluid-styles@2.0.7
PkgRadar flagged this 10 hours before MAL-2026-15826 was published. See the dated receipt and static evidence.
pkgradar.com
September 3, 2026 at 8:03 PM
pkgradar.bsky.social
⏱ Caught early: npm randompkga@1.0.4 was on our radar 29 days before MAL-2026-16255 went public.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm randompkga@1.0.4
PkgRadar flagged this 29 days before MAL-2026-16255 was published. See the dated receipt and static evidence.
pkgradar.com
September 18, 2026 at 8:18 PM
pkgradar.bsky.social
⏱ Caught early: npm jexkcode@1.0.1 was on our radar 2 days before MAL-2026-16220 went public.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm jexkcode@1.0.1
PkgRadar flagged this 2 days before MAL-2026-16220 was published. See the dated receipt and static evidence.
pkgradar.com
September 16, 2026 at 8:17 PM
pkgradar.bsky.social
⏱ 2 days of lead time on npm noblox-asset.js@7.4.0: we flagged it, then MAL-2026-16148 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm noblox-asset.js@7.4.0
PkgRadar flagged this 2 days before MAL-2026-16148 was published. See the dated receipt and static evidence.
pkgradar.com
September 15, 2026 at 8:16 PM
pkgradar.bsky.social
⏱ We flagged npm cr-bot-common@1.0.0 13 hours before the public advisory landed (MAL-2026-16137).

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm cr-bot-common@1.0.0
PkgRadar flagged this 13 hours before MAL-2026-16137 was published. See the dated receipt and static evidence.
pkgradar.com
September 12, 2026 at 8:12 PM
pkgradar.bsky.social
⏱ under an hour of lead time on npm strapi-plugin-vinsoc-1109@3.6.8: we flagged it, then MAL-2026-16126 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm strapi-plugin-vinsoc-1109@3.6.8
PkgRadar flagged this under an hour before MAL-2026-16126 was published. See the dated receipt and static evidence.
pkgradar.com
September 11, 2026 at 8:11 PM
pkgradar.bsky.social
⏱ Caught early: npm @neroxkira/vangal-baileys@1.0.0 was on our radar 11 days before MAL-2026-16103 went public.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm @neroxkira/vangal-baileys@1.0.0
PkgRadar flagged this 11 days before MAL-2026-16103 was published. See the dated receipt and static evidence.
pkgradar.com
September 10, 2026 at 8:10 PM
pkgradar.bsky.social
⏱ We flagged npm @fyxzpediaa/baileys@8.1.2 5 days before the public advisory landed (MAL-2026-16070).

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm @fyxzpediaa/baileys@8.1.2
PkgRadar flagged this 5 days before MAL-2026-16070 was published. See the dated receipt and static evidence.
pkgradar.com
September 9, 2026 at 8:09 PM
pkgradar.bsky.social
⏱ We flagged npm @usemosaik/template-react-js@1.0.1 3 days before the public advisory landed (MAL-2026-16047).

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm @usemosaik/template-react-js@1.0.1
PkgRadar flagged this 3 days before MAL-2026-16047 was published. See the dated receipt and static evidence.
pkgradar.com
September 8, 2026 at 8:08 PM
pkgradar.bsky.social
⏱ We flagged pypi dbt-sa-cli@0.0.1 1 hour before the public advisory landed (MAL-2026-15934).

#flaggedfirst #PyPI #malware #supplychainsecurity
Flagged first: pypi dbt-sa-cli@0.0.1
PkgRadar flagged this 1 hour before MAL-2026-15934 was published. See the dated receipt and static evidence.
pkgradar.com
September 5, 2026 at 8:05 PM
pkgradar.bsky.social
⏱ We flagged npm box-sign-client-poc@1.0.0 9 days before the public advisory landed (MAL-2026-15921).

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm box-sign-client-poc@1.0.0
PkgRadar flagged this 9 days before MAL-2026-15921 was published. See the dated receipt and static evidence.
pkgradar.com
September 4, 2026 at 8:04 PM
pkgradar.bsky.social
⏱ We flagged npm spc-grafeno-login@1.0.0 2 days before the public advisory landed (MAL-2026-15633).

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm spc-grafeno-login@1.0.0
PkgRadar flagged this 2 days before MAL-2026-15633 was published. See the dated receipt and static evidence.
pkgradar.com
September 2, 2026 at 8:02 PM
pkgradar.bsky.social
⏱ Caught early: pypi pyservercheck@0.1.1 was on our radar 2 hours before MAL-2026-15603 went public.

#flaggedfirst #PyPI #malware #supplychainsecurity
Flagged first: pypi pyservercheck@0.1.1
PkgRadar flagged this 2 hours before MAL-2026-15603 was published. See the dated receipt and static evidence.
pkgradar.com
August 31, 2026 at 7:59 PM
pkgradar.bsky.social
⏱ Before the advisory: our scan flagged npm supersignaturenature@1.0.6 1 day ahead of MAL-2026-15560.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm supersignaturenature@1.0.6
PkgRadar flagged this 1 day before MAL-2026-15560 was published. See the dated receipt and static evidence.
pkgradar.com
August 30, 2026 at 7:19 PM
pkgradar.bsky.social
⏱ 39 days of lead time on npm @fleetbo/svro@0.0.5: we flagged it, then MAL-2026-14586 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm @fleetbo/svro@0.0.5
PkgRadar flagged this 39 days before MAL-2026-14586 was published. See the dated receipt and static evidence.
pkgradar.com
August 28, 2026 at 6:34 PM
pkgradar.bsky.social
⏱ Caught early: pypi pybitjs@0.1.0 was on our radar 1 hour before MAL-2026-14545 went public.

#flaggedfirst #PyPI #malware #supplychainsecurity
Flagged first: pypi pybitjs@0.1.0
PkgRadar flagged this 1 hour before MAL-2026-14545 was published. See the dated receipt and static evidence.
pkgradar.com
August 27, 2026 at 6:32 PM
pkgradar.bsky.social
⏱ Caught early: npm spf-analytics@1.0.0 was on our radar 3 days before MAL-2026-14486 went public.

#flaggedfirst #npm #malware #supplychainsecurity
Flagged first: npm spf-analytics@1.0.0
PkgRadar flagged this 3 days before MAL-2026-14486 was published. See the dated receipt and static evidence.
pkgradar.com
August 26, 2026 at 6:28 PM
pkgradar.bsky.social
⏱ We flagged pypi quatre@3.0.0 41 days before the public advisory landed (MAL-2026-7465).

#flaggedfirst #PyPI #malware #supplychainsecurity
Flagged first: pypi quatre@3.0.0
PkgRadar flagged this 41 days before MAL-2026-7465 was published. See the dated receipt and static evidence.
pkgradar.com
August 24, 2026 at 6:18 PM