Skip to main content
The false-positive endpoint returns two kinds of records:
  • Reclassifications: Records that were originally classified by OpenSourceMalware as malicious but were subsequently determined by an admin to be false positives, or were retracted by the source feed (e.g. OSV). Where a withdrawal matches an OpenSourceMalware threat record, it’s merged into that threat’s entry rather than listed twice.
  • Rejections: Submissions that OpenSourceMalware rejected, meaning they were never added to the verified findings feed, because they were determined to be false positives.
Both types surface as source: "threat" items with the same shape. The false_positive.rejection_reason and rejection_note fields explain why a given item was marked a false positive, whether it had previously been verified as malicious or was rejected before ever reaching that status. Upstream withdrawals that don’t match any existing OpenSourceMalware threat record appear separately as source: "osv_withdrawal" items.
Subscription Required: This is a paid endpoint.
Use this endpoint to:
  • Retract stale alerts and blocks: If a package you already flagged, whether pulled from threat-feed’s verified threats or from unverified submissions, later appears here as a false positive, close the alert or lift the block automatically instead of waiting for someone to notice.
  • Audit other feeds you’re consuming: Cross-reference entries from other vendors’ threat feeds against this endpoint. If another feed still lists something OpenSourceMalware has confirmed benign, that’s evidence to raise with the vendor.
  • Turn silence into a signal: When OpenSourceMalware doesn’t flag something another feed does, this endpoint tells you whether that’s because OpenSourceMalware reviewed it and rejected it as benign (it’ll show up here), or because OpenSourceMalware hasn’t looked at it yet (it won’t appear anywhere).
  • Pick up upstream retractions: Catch OSV advisories withdrawn at the source, even for packages OpenSourceMalware never carried a matching threat record for.
If a package shows up in another vendor’s threat feed but also appears here with source: "threat", that’s confirmation OpenSourceMalware reviewed it and rejected it as benign. Surface that context next to the other feed’s alert instead of treating OpenSourceMalware’s silence as a miss.
Endpoint
Required header

​
Query parameters

Unlike threat-feed, this endpoint isn’t scoped by ecosystem. Results span every ecosystem and asset type OpenSourceMalware tracks, so there’s no need to loop over ecosystems to get full coverage.

​
Response example

​
Success (200)

Items are sorted by marked_at descending: for threat items, when the status was changed to false_positive; for osv_withdrawal items, the OSV withdrawal date.

​
Item shape by source

  • threat items cover both reclassifications and rejections. They carry package_name, registry, and a false_positive object with rejection_reason and rejection_note explaining the determination. If the same correction also involved an upstream OSV withdrawal, osv_withdrawn and osv_ids are included. There’s no separate field distinguishing a reclassification from a rejection; read rejection_reason and rejection_note to tell which kind of record you’re looking at.
  • osv_withdrawal items are upstream OSV advisories withdrawn with no corresponding OpenSourceMalware threat record. They carry osv_id and ecosystem instead of registry, and have no false_positive object.

​
Matching items to your own feeds

When cross-referencing an entry from another feed against this endpoint:
  1. Match on identifier first. If the other feed carries an OSV, GHSA, or CVE id, compare it against false_positive.osv_ids (for source: "threat" items) or osv_id (for source: "osv_withdrawal" items). This is more precise than name matching and avoids collisions across ecosystems.
  2. Fall back to package name and ecosystem. If no id is available, match on package_name plus the ecosystem field, noting that the field is named registry on threat items and ecosystem on osv_withdrawal items.

​
Errors

​
cURL examples

Poll for the latest false positives:
Only reclassifications and rejections from OpenSourceMalware’s own findings:
Only advisories withdrawn upstream in OSV:
If a package shows up in another vendor’s threat feed but also appears here with source: "threat", that’s not a gap in OpenSourceMalware’s coverage, it’s confirmation OpenSourceMalware reviewed it and rejected it as benign. Surface that context next to the other feed’s alert instead of treating OpenSourceMalware’s silence as a miss.