Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH034

How does the Node.js security release of 21 October 2026 reach nodejs.org's downloads, beside the Python releases and the PHP fix?

In short. The same question for Node.js's security release of 21 October, from nodejs.org's own download counts. By day 14 (4 November, unreviewed checkpoint) the fixed release or a newer one made up 63 per cent of line 22's downloads, 70 per cent of line 24's and 95 per cent of line 26's. A download is a request, not a machine, and nodejs.org is one channel of several. This record stops at day 7; the day-30 read is due on 22 November.

Latest read, 9 November 2026 (unreviewed working note): On day 18 after Node.js's fix (8 November), 61.8 per cent of line 22's downloads from nodejs.org were at or above the fixed release, 68.2 per cent of line 24's and 94.4 per cent of line 26's, close to where they stood on day 14; 13.2 per cent came from lines the release does not fix. Node.js's site asks automated readers not to fetch its release list, so from today the study uses the copy it kept on 5 November. Working record, unreviewed. Read the note

Study, version 0.1 (interim, to day 7), 30 October 2026 studies/LH034/LH034.md

Checkpoints

The working notes written at each read, newest first. They are unreviewed: a finding reaches a piece only after review.

From studies/LH034/ in the repository, last changed 9 November 2026.