False positives

The false-positive endpoint returns two kinds of records:

Reclassifications: Records that were originally classified by OpenSourceMalware as malicious but were subsequently determined by an admin to be false positives, or were retracted by the source feed (e.g. OSV).
Rejections: Submissions that OpenSourceMalware rejected, meaning they were never added to the verified findings feed, because they were determined to be false positives.

Subscription Required: This is a paid endpoint. Check out our pricing and contact us for more info.

Use this endpoint to:

Retract stale alerts and blocks: If a package you already flagged, whether pulled from threat-feed’s verified threats or from unverified submissions, later appears here as a false positive, close the alert or lift the block automatically instead of waiting for someone to notice.
Audit other feeds you’re consuming: Cross-reference entries from other vendors’ threat feeds against this endpoint. If another feed still lists something OpenSourceMalware has confirmed benign, that’s evidence to raise with the vendor.
Turn silence into a signal: When OpenSourceMalware doesn’t flag something another feed does, this endpoint tells you whether that’s because OpenSourceMalware reviewed it and rejected it as benign (it’ll show up here), or because OpenSourceMalware hasn’t looked at it yet (it won’t appear anywhere).
Pick up upstream retractions: Catch OSV advisories withdrawn at the source, even for packages OpenSourceMalware never carried a matching threat record for.

If a package shows up in another vendor’s threat feed but also appears here, that’s confirmation OpenSourceMalware reviewed it and rejected it as benign. Surface that context next to the other feed’s alert instead of treating OpenSourceMalware’s silence as a miss.

Endpoint

GET https://api.opensourcemalware.com/functions/v1/false-positive

Required Header

Authorization: Bearer osm_your_token

Query Parameters

Parameter	Type	Required	Default	Description
`ecosystem`	string	Required	—	Target registry or ecosystem (e.g. `npm`, `pypi`, `rubygems`, `crates`, `go`, `maven`, `nuget`, `openvsx`), or threat meta-types (`repositories`, `domains`). Case-insensitive.
`hours`	integer	Optional	`1`	Lookback window in hours (`1` to `24`). Returns false positives updated or withdrawn within this trailing window.
`source`	string	Optional	`all`	Filter by record source: `threat` (OSM reclassifications and rejections) or `osv_withdrawal` (unmatched upstream OSV retractions).

Unlike the search API, the false-positive endpoint is scoped by ecosystem. Note that upstream OSV withdrawals only track package ecosystems; queries for repositories or domains return source: "threat" records only.

Response Structure

Success (200 OK)

{
  "count": 2,
  "window_hours": 1,
  "ecosystem": "npm",
  "from": "2026-10-01T19:30:00.000Z",
  "to": "2026-10-01T20:30:00.000Z",
  "sources": {
    "threats": 1,
    "osv_withdrawals": 1
  },
  "false_positives": [
    {
      "source": "threat",
      "marked_at": "2026-10-01T20:15:00.000Z",
      "id": "3f848bb2-901b-4cf7-8023-e6ef61a0840b",
      "report_type": "package",
      "registry": "npm",
      "package_name": "demo-telemetry-sdk",
      "resource_identifier": "demo-telemetry-sdk",
      "version_info": "*",
      "severity_level": "critical",
      "status": "false_positive",
      "tags": ["benign", "research"],
      "created_at": "2026-09-28T10:14:00.000Z",
      "updated_at": "2026-10-01T20:15:00.000Z",
      "last_updated": "2026-10-01T20:15:00.000Z",
      "first_seen": "2026-09-28T10:14:00.000Z",
      "last_seen": null,
      "threat_description": "Flagged for anomalous preinstall script execution.",
      "payload_description": "Network beacon in preinstall script.",
      "evidence_references": "https://scanner.example.com/npm/demo-telemetry-sdk",
      "researcher": null,
      "researcher_organization": null,
      "osm_url": "https://opensourcemalware.com/npm/demo-telemetry-sdk",
      "originally_reported_by": {
        "reporting_entity": "example-vendor",
        "reporting_url": "https://scanner.example.com/npm/demo-telemetry-sdk"
      },
      "false_positive": {
        "rejection_reason": "security_advisory_publication",
        "rejection_note": "Confirmed benign research demo with no exfiltration payload.",
        "originally_reported_by": {
          "reporting_entity": "example-vendor",
          "reporting_url": "https://scanner.example.com/npm/demo-telemetry-sdk"
        },
        "osv_advisory_url": "https://osv.dev/vulnerability/GHSA-xxxx-xxxx-xxxx",
        "ghsa_advisory_url": null,
        "osv_withdrawn": true,
        "osv_ids": [
          "GHSA-xxxx-xxxx-xxxx"
        ],
        "osv_withdrawn_at": "2026-10-01T19:50:00.000Z"
      }
    },
    {
      "source": "osv_withdrawal",
      "marked_at": "2026-10-01T19:40:00.000Z",
      "id": "8bb544c1-d227-4a0b-9dfa-013897451a99",
      "report_type": "package",
      "registry": "npm",
      "package_name": "retracted-helper",
      "resource_identifier": "retracted-helper",
      "version_info": null,
      "severity_level": null,
      "status": "false_positive",
      "tags": [],
      "created_at": "2026-10-01T19:40:00.000Z",
      "updated_at": "2026-10-01T19:40:00.000Z",
      "last_updated": "2026-10-01T19:40:00.000Z",
      "first_seen": null,
      "last_seen": null,
      "threat_description": null,
      "payload_description": null,
      "evidence_references": null,
      "researcher": null,
      "researcher_organization": null,
      "osm_url": null,
      "originally_reported_by": {
        "reporting_entity": "osv",
        "reporting_url": "https://osv.dev/vulnerability/MAL-2026-9999"
      },
      "false_positive": {
        "rejection_reason": "osv_withdrawn",
        "rejection_note": null,
        "originally_reported_by": {
          "reporting_entity": "osv",
          "reporting_url": "https://osv.dev/vulnerability/MAL-2026-9999"
        },
        "osv_advisory_url": "https://osv.dev/vulnerability/MAL-2026-9999",
        "ghsa_advisory_url": null,
        "osv_withdrawn": true,
        "osv_ids": [
          "MAL-2026-9999"
        ],
        "osv_withdrawn_at": "2026-10-01T19:40:00.000Z",
        "osv_id": "MAL-2026-9999",
        "ecosystem": "npm",
        "advisory_path": "MAL/2026/MAL-2026-9999.json"
      }
    }
  ]
}

Items in false_positives are sorted by marked_at descending:

For threat items, marked_at represents the timestamp when the status was set to false_positive.
For osv_withdrawal items, marked_at represents when the advisory was withdrawn in OSV.

Attribution (`originally_reported_by`)

Each record includes an attribution block at both the top level and inside the nested false_positive object, identifying who originally claimed the package was malicious:

"originally_reported_by": {
  "reporting_entity": "socket",
  "reporting_url": "https://scanner.example.com/npm/demo-telemetry-sdk"
}

reporting_entity: Derived in order of precedence:
1. Explicit analyst attribution recorded during submission review
2. Detected vendor host in evidence references
3. Associated researcher organization or independent researcher
4. Fallback identifier: community-member
reporting_url: Direct link to the scanner report, CVE/GHSA advisory, or evidence reference document.

Matching Items to Your Internal Feeds

When cross-referencing an alert from another feed or scanner against OpenSourceMalware false positives:

Match on identifier first: If your feed carries an OSV, GHSA, or CVE identifier, check against false_positive.osv_ids. This is the most deterministic match and avoids naming collisions across registries.
Match on package name and ecosystem: If no vulnerability identifier is available, match on package_name and registry (or resource_identifier).
De-duplicate using id and source: If an analyst updates notes or metadata on an existing false positive, its marked_at timestamp will update. De-duplicate locally using id and source.

cURL Examples

Poll npm false positives in the last hour (recommended polling cadence)

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/false-positive?ecosystem=npm"

Poll PyPI false positives across the last 24 hours

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/false-positive?ecosystem=pypi&hours=24"

Filter exclusively for OpenSourceMalware determinations

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/false-positive?ecosystem=npm&source=threat"

Filter exclusively for upstream OSV retractions

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/false-positive?ecosystem=npm&source=osv_withdrawal"

Query false positives for repository assets

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/false-positive?ecosystem=repositories&hours=12"

Errors

API error responses

Click this card for the complete list of standard API error responses and status codes.

Overview

Free Endpoints

Paid Endpoints

Endpoint

Required Header

Query Parameters

Response Structure

Success (200 OK)

Attribution (`originally_reported_by`)

Matching Items to Your Internal Feeds

cURL Examples

Poll npm false positives in the last hour (recommended polling cadence)

Poll PyPI false positives across the last 24 hours

Filter exclusively for OpenSourceMalware determinations

Filter exclusively for upstream OSV retractions

Query false positives for repository assets

Errors

API error responses

​Endpoint

​Required Header

​Query Parameters

​Response Structure

​Success (200 OK)

​Attribution (originally_reported_by)

​Matching Items to Your Internal Feeds

​cURL Examples

​Poll npm false positives in the last hour (recommended polling cadence)

​Poll PyPI false positives across the last 24 hours

​Filter exclusively for OpenSourceMalware determinations

​Filter exclusively for upstream OSV retractions

​Query false positives for repository assets

​Errors

API error responses

Endpoint

Required Header

Query Parameters

Response Structure

Success (200 OK)

Attribution (`originally_reported_by`)

Matching Items to Your Internal Feeds

cURL Examples

Poll npm false positives in the last hour (recommended polling cadence)

Poll PyPI false positives across the last 24 hours

Filter exclusively for OpenSourceMalware determinations

Filter exclusively for upstream OSV retractions

Query false positives for repository assets

Errors