Rate a supply chain incident by what the bad code could reach and whether it ran, not by a CVSS score. Ask four questions: was it present, did it execute, what could it read, and did anything leave. The answers place you on a simple four level scale that your team can agree on in advance.
Why CVSS does not fit
CVSS describes a flaw in software. A malicious release is not a flaw, it is code that does what its author wants. The impact depends on where it ran, so severity has to come from your environment. A bad version that sits unused in one lockfile is a different event from one that ran in a job holding publish keys.
A four level scale
| Level | Condition | Typical response |
|---|---|---|
| 1 Watch | Affected version exists in an advisory, not found in your estate | Search, record the negative result |
| 2 Present | Found in a lockfile or SBOM, never built or run | Pin, rebuild, no rotation |
| 3 Executed | Ran in CI or on a developer machine | Rotate reachable secrets, review changes |
| 4 Shipped or exfiltrated | Reached production or customers, or evidence of outbound data | Full incident, customer comms, legal review |
Questions that move you up a level
- Did a build or install happen while the bad version was available?
- Did install scripts or import time code run? By default npm runs lifecycle scripts of installed packages unless ignore-scripts is set.
- What secrets could that environment read?
- Is there outbound traffic to unfamiliar hosts?
- Did the artifact reach customers?
How to use it
Agree the table before an incident. Name who can raise a level and who must approve a lower one. When unsure, start one level higher and downgrade with evidence. A level 3 or 4 is a good point to call a formal incident, as covered in declaring an incident early.
Example walkthrough
A team finds a bad version in the lockfile of an internal tool that was never built during the window. That is level 2: pin and rebuild. Later a developer reports a local install at the time, so the level moves to 3 for that machine: rotate what it could read and review its recent changes. If the same version is found in an image running in production, the event moves to level 4 and the notification questions start. Write each move and the reason in the log.
Quick check
Can level 2 become level 3?
Yes. If a later search finds an old build or a developer install, move up and follow the higher playbook.
Does a scanner finding set the level?
It supplies evidence for the first question, not the level. Execution and reach decide.
Safeguard's dependency scanning and SBOMs can help answer the first question quickly. A free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
