{
  "id": 7282872,
  "title": "We measured how late a malware advisory arrives. Sometimes 95 days.",
  "url": "https://urgent.news/2026/09/14/we-measured-how-late-a-malware-advisory-arrives-sometimes-95-days",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-14T08:49:31.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mag_solutions_ai/we-measured-how-late-a-malware-advisory-arrives-sometimes-95-days-fn1"
  },
  "original_language": "en",
  "account": "A recent study examined the delay between when malware enters the npm ecosystem and when a corresponding advisory is issued, revealing that the average lag time is a staggering 95 days. This blind spot stems from the fact that dependency scanners lacking new vulnerability reports cannot flag unknown threats, treating unreported malicious packages as harmless. To quantify the window of vulnerability, researchers analyzed the 100 most recent malware advisories for npm packages from the GitHub Advisory Database, measuring the time difference between when the advisory appeared and when the affected package was first published on the npm registry.\n\nThe findings showed that while 95% of these packages were less than 30 days old when the advisory arrived, 30% experienced a window longer than a day. The longest observed delay was an astonishing 95 days, affecting the unifi-credential-server package, during which every CVE-based scanner would have deemed the package clean. This highlights the significance of timing, as the signal for 95% of these packages lies in their age and minimal usage, which can be determined from the registry immediately upon dependency appearance in a pull request.\n\nHowever, the study emphasizes that advisory-based scanning remains effective, with tools like Dependabot, Snyk, and GitHub's own tools detecting the vast majority of real risks, including 70% of cases where the advisory arrived promptly. The authors stress that age alone is not a reliable indicator, as most new packages are merely newly released. Their own observations reveal that a rare rule combining recent publication with minimal adoption effectively identifies genuine threats. Furthermore, their research underscores that they are not the only ones scrutinizing this issue, as competitors have developed behavioral analysis tools to enhance detection capabilities.\n\nBy publishing these findings, the authors aim to provide verifiable data for the cybersecurity community to assess the efficacy of their defenses against emerging threats. They caution against overestimating the prevalence of AI-generated malicious packages, noting that their measurements indicate a negligible presence compared to actual risks. Ultimately, the study encourages a nuanced understanding of the challenges in detecting and mitigating malware within the npm ecosystem.",
  "summary": "Every dependency scanner that works from known vulnerabilities has the same blind spot, and it is not a bug: it cannot warn you about something nobody has reported yet. Between the moment an attacker publishes a malicious package and the moment an advisory exists, every one of those tools reports the package as fine, because from their point of view it genuinely is. The interesting question is…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}