Supported asset types
OpenSourceMalware tracks threats across a broad range of asset types in one unified database. The one rule? All assets relate to the delivery of malicious open source.Packages
Malicious packages on npm, PyPI, Maven, NuGet, RubyGems, Packagist, Crates.io, Go Modules, VS Code Marketplace, Open VSX, and AI Skills registries.
Container images
Malicious container images on Docker Hub, GitHub Container Registry (GHCR), Quay, and other registries.
Repositories
GitHub, GitLab, and Bitbucket repositories that contain malicious code or serve as staging infrastructure for payload distribution.
Domains & URLs
Command-and-control (C2) servers, phishing domains, and specific malicious URLs used to deliver payloads or exfiltrate data.
IP addresses
Malicious IP addresses tied to C2 infrastructure, attack sources, and known threat actor networks.
Crypto wallets
Cryptocurrency wallet addresses embedded in malicious payloads as a covert channel to relay commands or exfiltrate data.
How it works
OpenSourceMalware is built on a community-driven verification pipeline. When a threat is reported, it’s reviewed and validated before being published to the database. Every entry you query reflects a verified signal, not unvetted noise.- Community reports — anyone user can submit a threat report for a package, repository, URL, domain, IP, wallet, or container image.
- Verification — select community members and maintainers review reports for accuracy and quality before they are accepted.
- Published to the database — verified threats are added to the database with metadata including severity, tags, and timestamps.
- Queryable via API — you can check any resource against the database in real time using the REST API.
Ways to use OpenSourceMalware
OpenSourceMalware is useful across a range of security and development roles:- Security teams integrating automated threat checks into CI/CD pipelines, dependency scanners, or SIEM workflows
- Developers who want to verify a package or repository before adding it as a dependency
- Researchers tracking malware campaigns, attack infrastructure, or supply-chain threats
Enhance your research
- Study malware trends, threat actors, campaigns, or attack techniques
- Academic or independent security research
Protect your organization
- Use threat records to investigate whether your organization has been exposed to a known threat
- Check whether a software package is malicious before using it in your own projects
- Build an internal platform to serve internal customers (e.g. analysts)
- Feed data into your internal tools, processes, or pipelines to help your security team work more effectively
- Respond to a security incident inside your own organization
- Produce internal reports, briefings, or executive summaries (including sharing those with leadership, legal counsel, or your cyber insurer in connection with an incident)
Where to go next
Quickstart
Make your first API threat check in under 5 minutes.
API overview
Explore all endpoints for querying and submitting threat data.
Report a threat
Learn how to submit high-quality threat reports to the community database.
Community guidelines
Understand the standards that keep OSM accurate and trustworthy.