{
  "$comment": "Machine-readable dataset behind supplychain.24h.sh. Advisory counts come from the OSSF Malicious Packages database distributed through OSV.dev, per-ecosystem dumps downloaded 2026-08-24, counting only records with the MAL- prefix. Live registry state was probed against each registry's own public API on the same date.",
  "updated": "2026-08-24",
  "advisories_total": 235992,
  "withdrawn": 351,
  "ecosystems": [
    { "id": "npm",        "name": "npm",        "advisories": 219998, "campaign": 140728, "probed": 800, "hard404_pct": null,  "dated_receipt": true },
    { "id": "pypi",       "name": "PyPI",       "advisories": 11667,  "campaign": 0, "probed": 300, "hard404_pct": 98.3, "dated_receipt": false },
    { "id": "rubygems",   "name": "RubyGems",   "advisories": 3512,   "campaign": 0, "probed": 200, "hard404_pct": 99.0, "dated_receipt": false },
    { "id": "nuget",      "name": "NuGet",      "advisories": 777,    "campaign": 0, "probed": 150, "hard404_pct": 98.7, "dated_receipt": false },
    { "id": "crates",     "name": "crates.io",  "advisories": 19,     "campaign": 0, "probed": 19,  "hard404_pct": null, "dated_receipt": false },
    { "id": "go",         "name": "Go",         "advisories": 18,     "campaign": 0, "probed": 18,  "hard404_pct": null, "dated_receipt": false },
    { "id": "packagist",  "name": "Packagist",  "advisories": 1,      "campaign": 0, "probed": 1,   "hard404_pct": null, "dated_receipt": false }
  ],
  "npm_detection_sources": {
    "amazon-inspector": 146010,
    "ghsa-malware": 22453,
    "reversing-labs": 5895,
    "ossf-package-analysis": 4876,
    "google-open-source-security": 819,
    "checkmarx": 71
  },
  "sample": {
    "seed": 42,
    "npm_total": 800,
    "npm_campaign": 400,
    "npm_other": 400
  },
  "package_level": [
    { "verdict": "Tombstoned, name locked", "n": 509, "pct": 63.6 },
    { "verdict": "Serves a real tarball", "n": 207, "pct": 25.9 },
    { "verdict": "Unpublished, name free again", "n": 75, "pct": 9.4 },
    { "verdict": "Hard 404", "n": 9, "pct": 1.1 }
  ],
  "version_level": [
    { "verdict": "Tombstoned", "n": 509, "pct": 63.6 },
    { "verdict": "Flagged version returns HTTP 200", "n": 188, "pct": 23.5 },
    { "verdict": "Unpublished", "n": 75, "pct": 9.4 },
    { "verdict": "Versions excised, package alive", "n": 19, "pct": 2.4 },
    { "verdict": "Hard 404", "n": 9, "pct": 1.1 }
  ],
  "funnel": [
    { "step": "Package still resolves", "value": 25.9, "basis": "207 of 800 sampled npm advisories", "misses": "surgical version removal: the package lives, the poisoned version is gone" },
    { "step": "Flagged version returns 200", "value": 23.5, "basis": "188 of 800", "misses": "version-number reuse: the maintainer republished that number with clean code" },
    { "step": "Excluding the token campaign", "value": 1.0, "basis": "4 of 400 non-campaign advisories", "misses": "a withdrawn advisory and one clean tarball still counted" },
    { "step": "Confirmed by opening the archive", "value": 0.5, "basis": "2 of 399 real npm advisories", "misses": null }
  ],
  "content_verified": [
    { "package": "@budetzz/libsignal-node", "version": "2.0.15", "advisory": "MAL-2026-4373",  "verdict": "excluded", "note": "advisory withdrawn 2026-05-26" },
    { "package": "jest-canvas-mock",        "version": "2.5.3",  "advisory": "MAL-2026-4136",  "verdict": "not exposed", "note": "version number reused, the served tarball is clean" },
    { "package": "streak-view-core",        "version": "1.0.0",  "advisory": "MAL-2026-12471", "verdict": "confirmed", "note": "contains indexCache, as described" },
    { "package": "boxy-temper",             "version": "35.1.5", "advisory": "MAL-2026-13087", "verdict": "confirmed", "note": "contains _bridge.js and a workers.dev reference" }
  ],
  "time_to_removal_hours": {
    "scope": "npm removals with a dated receipt, N=381, excluding the November 2025 bulk sweep",
    "median": 405.5,
    "p25": 29.8,
    "p75": 1427,
    "p90": 7620,
    "within_24h_pct": 24.1,
    "within_7d_pct": 34.4,
    "campaign_naive_median": 13147,
    "campaign_sweep_share": "204 of 216 removals fell in November 2025"
  },
  "order_of_events_pct": { "removed_before_advisory": 44.2, "removed_after_advisory": 47.6, "same_hour": 8.2 },
  "after_advisory_hours": { "median": 35.9, "p75": 57.2, "p90": 460.0 }
}