While writing yesterday’s note, I realized that some malware sat on npm for six months before the advisory database most tools read caught up. So, I wondered… how fast does the news about a vulnerability travel? I picked 20 CVEs at random and split them up into two groups of 10: the “loud” ones (exploited in the wild: attackers are already using them) and the “quiet” ones (ordinary bugs in npm and PyPI packages).
My methodology: 20 CVEs from 2026, picked before looking at any spread data. Loud: 10 bugs added to CISA's list of exploited bugs (KEV) between August and November, one per vendor. Quiet: 5 npm + 5 PyPI advisories reviewed by GitHub, not on KEV. For each, the first time it showed up on X, Reddit, Google News, GitHub, CISA's list, plus the fixed version and public exploit repos ("poc", "exploit" or "rce" in the name; I didn't open them, and fake ones that ship malware are common).
Caveats: n = 20: this is a field note. "First seen" is the earliest result a search API returned, so the real first post may be even earlier. CISA and many news dates are by day. The time axis stretches the first hours and squeezes the weeks.
Data via looot (disclosure: I'm a cofounder): X, Reddit, Google News, GitHub, OSV, CVE.org, NVD, CISA KEV.