Detection Ledger

Full commit history and JSON artifacts: github.com/attestd-io/detection-ledger

Incidents committed to the ledger at or near detection time. GitHub commit timestamps match detection time for these entries.

Incidents registered before the ledger repository existed. The attestd_detected_at field reflects internal database records where available. Ledger commits were created in June 2026.

How timestamps are defined

Attestd detected is the earliest first_seen_at timestamp from supply_chain_compromised_versions for the incident's packages, the point at which the API began returning compromised: true for those versions. If first_seen_at postdates press coverage, the detection time is omitted rather than published.

OSV published is the earliest published timestamp across all MAL-* advisories linked to the incident's packages.

Press coverage is the publication time of the first cited article, manually verified.

Detection source discloses how the incident entered Attestd. registry means the package was detected via PyPI yank or npm unpublish monitoring. news_monitor means automated RSS extraction from security blogs. osv means the OSV ingestion pipeline indexed the MAL advisory directly. OSV-sourced incidents are included in the table for coverage completeness but are excluded from the lead-time metric, since they are by definition indexed after OSV publishes. The news_monitor and registry sources are the only ones counted toward the lead-time metric.

Historical commit dates are the ledger creation date, not the detection date. Future incidents will be committed in real time, and the GitHub commit timestamp will match detection time.