GitHub Advisory Database
Safeguard articles tagged "GitHub Advisory Database" — guides, analysis, and best practices for software supply chain and application security.
7 articles
"Fully Compromised": What 7,700 npm Malware Advisories Say, and What the Analysis Adds
GitHub's npm malware advisories tell you to treat the machine as fully compromised and rotate every secret. OSV's 2026 data: 7,700 npm records carry that paragraph, 2,018 carry nothing else, and 5,682 include an analysis of what the code did. Where they part ways, and a script to scope your response.
When GitHub and OSV Disagree on Affected Versions: The Range Gap in 2026 Advisories
A GitHub advisory can record 'affected below X' and 'patched in Y' with Y above X. OSV-based tools flag the releases in between, GitHub's range calls them safe. 2026 data across eight ecosystems, three cases that went different ways (vm2, Angular, Hazelcast), and a script that finds the gaps in your lockfiles.
Old Bug, New CVE: Why 373 CVEs in 2026 Arrived Months After the Advisory
CVE-2024-58398 was published on 17 October 2026 for a Coder bug disclosed and fixed in October 2024. In 2026, 373 CVEs arrived three months or more after GitHub's advisory, 311 of them from VulnCheck. Data across eight ecosystems, the CNA rules behind late IDs and old years, and a script that tells a new bug from an old one.
Fixing the Fix: Incomplete-Fix Advisories Are Six Times More Common in 2026
We counted GitHub-reviewed advisories that describe an incomplete fix or patch bypass. In 2026 they are 2.31% of all advisories, up from under 0.4% a year. The data, the bug classes that keep coming back, and what to change in how you ship a fix.
How Long Until Your Scanner Knows? GitHub Advisory Review Lag Hit a 38-Day Median in June 2026
A CVE being public and your scanner knowing about it are two different events. For open-source packages, the gap between them is mostly the time it takes GitHub to review the advisory and map it to a package name and version range. In 2025 that usually took about half a day. In June 2026 the median was 38 days.
A Clean Scan Can Also Mean the Vulnerability Data Hasn't Caught Up
A dependency scan that reports nothing has one of two meanings. Either the scanner checked your packages and the vulnerability data found nothing wrong, or the data didn't yet know about something that is wrong. Both produce the same green build.
The Fix Ships First: In 2026, Patched Releases Beat the Advisory by a Median of 10 Days
In 97% of 4,259 PyPI and npm advisories published in 2026, the fixed version was on the registry before the advisory went public, by a median of 10 days. Why the advisory is a late signal, this week's examples, and how to watch releases without walking into compromised updates.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.