OSV
Safeguard articles tagged "OSV" — guides, analysis, and best practices for software supply chain and application security.
14 articles
"Fully Compromised": What 7,700 npm Malware Advisories Say, and What the Analysis Adds
GitHub's npm malware advisories tell you to treat the machine as fully compromised and rotate every secret. OSV's 2026 data: 7,700 npm records carry that paragraph, 2,018 carry nothing else, and 5,682 include an analysis of what the code did. Where they part ways, and a script to scope your response.
When GitHub and OSV Disagree on Affected Versions: The Range Gap in 2026 Advisories
A GitHub advisory can record 'affected below X' and 'patched in Y' with Y above X. OSV-based tools flag the releases in between, GitHub's range calls them safe. 2026 data across eight ecosystems, three cases that went different ways (vm2, Angular, Hazelcast), and a script that finds the gaps in your lockfiles.
Old Bug, New CVE: Why 373 CVEs in 2026 Arrived Months After the Advisory
CVE-2024-58398 was published on 17 October 2026 for a Coder bug disclosed and fixed in October 2024. In 2026, 373 CVEs arrived three months or more after GitHub's advisory, 311 of them from VulnCheck. Data across eight ecosystems, the CNA rules behind late IDs and old years, and a script that tells a new bug from an old one.
Malware Records List Versions, Not Packages: Why leakdeep 2.6.2 Scans Clean
Malware records usually list the exact versions someone analysed, and scanners match only those. 2026 OSV data for PyPI and npm, the leakdeep credential stealer whose version 2.6.2 isn't in its record, and a script that checks lockfiles by package name.
No-Fix Advisories Let Newer Versions Scan Clean: 2026 Data
534 of 569 no-fix advisories from 2026 use a version ceiling, and scanners treat anything above it as clean. For 54% of those we could check, a newer stable release already exists. Data, method and a checker.
31% of 2026 GitHub Repository Advisories Weren't in the Advisory Database: What Scanners Miss
We checked 2,486 GitHub repository advisories from 2026 against OSV. 30.7% weren't there, mostly recent ones. The data, the backlog, and a checker.
GitHub Withdrew 517 Duplicate Advisories in 2026: Where They Linger and How to Clean Up
GitHub withdrew 517 Go, npm and PyPI advisories in 2026, nearly all duplicates live for two weeks. Where they linger in your findings and a cleanup script.
Fixing the Fix: Incomplete-Fix Advisories Are Six Times More Common in 2026
We counted GitHub-reviewed advisories that describe an incomplete fix or patch bypass. In 2026 they are 2.31% of all advisories, up from under 0.4% a year. The data, the bug classes that keep coming back, and what to change in how you ship a fix.
How Long Until Your Scanner Knows? GitHub Advisory Review Lag Hit a 38-Day Median in June 2026
A CVE being public and your scanner knowing about it are two different events. For open-source packages, the gap between them is mostly the time it takes GitHub to review the advisory and map it to a package name and version range. In 2025 that usually took about half a day. In June 2026 the median was 38 days.
A Clean Scan Can Also Mean the Vulnerability Data Hasn't Caught Up
A dependency scan that reports nothing has one of two meanings. Either the scanner checked your packages and the vulnerability data found nothing wrong, or the data didn't yet know about something that is wrong. Both produce the same green build.
Credit the Tool: AI-Found Vulnerabilities Are Hiding in Free Text
CVE and OSV records already have a 'tool' credit type. Of 2,544 CVE records added on 13 and 14 October 2026, two used it. Why AI-found vulnerabilities should credit the tool, and why defenders should care.
Malicious Baileys Forks on npm: 240 Malware Records, and Why --ignore-scripts Doesn't Stop Them
Malicious Baileys forks use the bot's own WhatsApp session to follow channels. OSV data to 17 Oct, why npm defenses miss it, and a checker.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.