Home / Research
Research
Measured reports on npm supply-chain attacks and install-time detection — including what our own engine misses. Data and method published with each.
Two rules govern everything published here. Every figure is computed from data in this repository — the generator refuses to render a report containing a number it cannot derive. And the misses are published with the hits: a detection rate measured only against fixtures we wrote ourselves would report on our test suite, not on your risk.
-
What an install-time gate costs on packages nobody should stop
A false-positive baseline: DepWall's engine run against 5,973 of the most-depended-on npm packages, with every verdict, every signal that fired, and the interruption rate a developer would actually experience.
-
The limits of metadata-only detection on live npm malware
Most of the OSV malicious-package corpus has been unpublished, which makes the obvious benchmark meaningless. Measured against only the packages still installable today, metadata-only checks let most of them through.