Modify a threat report

The modify-threat-report endpoint lets you update a threat report, whether submitted by you or another community member. Only the fields you include in the request body will be changed. Fields you omit are left as-is. Use it to:

Add new evidence: Update a report with newly discovered IOCs, advisory URLs, or supporting references as your investigation develops.
Correct report details: Fix inaccurate severity assessments, version information, or payload descriptions after initial submission.
Expand threat coverage: Add tags, contributors, or updated publisher information as more becomes known about a threat actor or campaign.

Modified reports go through the community verification process before they are published to the database. This review ensures data quality and prevents false positives. You can track the status of your submissions from your profile on opensourcemalware.com.

Endpoint

PUT https://api.opensourcemalware.com/functions/v1/modify-threat-report

Required headers

Authorization: Bearer osm_your_token
Content-Type: application/json

Request body

You must include one of the following to identify the threat:

threat_id (the UUID of the threat report)
package_name (optionally combined with registry)
resource_identifier (optionally combined with registry)

Response examples

Success (200)

{
  "message": "Threat report updated successfully",
  "threat_id": "123e4567-e89b-12d3-a456-426614174000",
  "updated_fields": ["threat_description", "severity_level"],
  "status": "modified"
}

401 — No Authorization header

{ "error": "Authorization required" }

401 — Invalid API token

{ "error": "Invalid API token" }

429 — IP rate limit (whitelisted IPs bypass)

{ "error": "Rate limit exceeded for your IP address. Please try again later." }

429 — Modification rate limit (per hour)

{ "error": "Rate limit exceeded. Maximum 30 modifications per hour." }

30/hour for standard users. This limit may be increased by an admin.

405 — Method not allowed

{ "error": "Method not allowed" }

400 — No target identifier supplied

{ "error": "Missing required field: either threat_id, package_name, or resource_identifier is required" }

404 — Lookup by `package_name` returned nothing

{ "error": "No threat report found for this package name" }

404 — Lookup by `resource_identifier` returned nothing

{ "error": "No threat report found for this resource_identifier" }

404 — `threat_id` not found

{ "error": "Threat report not found" }

500 — Lookup by package_name failed

{
  "error": "Failed to lookup threat by package name",
  "details": "<postgres error message>"
}

500 — Lookup by resource_identifier failed

{
  "error": "Failed to lookup threat by resource_identifier",
  "details": "<postgres error message>"
}

500 — Fetch existing threat failed

{
  "error": "Failed to fetch threat report",
  "details": "<postgres error message>"
}

500 — Version-creation prefetch failed (pro-user edit path)

{ "error": "Failed to fetch threat for version creation" }

500 — Save proposed changes failed (pro-user edit path)

{
  "error": "Failed to save proposed changes",
  "details": "<postgres error message>"
}

500 — Admin/editor threat update failed

{
  "error": "Failed to update threat report",
  "details": "<postgres error message>"
}

500 — Admin/editor threat details update failed

{
  "error": "Failed to update threat details",
  "details": "<postgres error message>"
}

500 — Catch-all

{
  "error": "Internal server error",
  "details": "<exception message>"
}

cURL example

curl -X PUT "https://api.opensourcemalware.com/functions/v1/modify-threat-report" \
  -H "Authorization: Bearer osm_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "package_name": "malicious-package",
    "registry": "npm",
    "threat_description": "Updated: Package now includes additional malicious functionality.",
    "severity_level": "critical",
    "payload_description": "Downloads both cryptocurrency miner and keylogger.",
    "tags": ["cryptocurrency", "miner", "keylogger", "updated"]
  }'

Overview

Free Endpoints

Paid Endpoints

Request body

Response examples

Success (200)

401 — No Authorization header

401 — Invalid API token

429 — IP rate limit (whitelisted IPs bypass)

429 — Modification rate limit (per hour)

405 — Method not allowed

400 — No target identifier supplied

404 — Lookup by `package_name` returned nothing

404 — Lookup by `resource_identifier` returned nothing

404 — `threat_id` not found

500 — Lookup by package_name failed

500 — Lookup by resource_identifier failed

500 — Fetch existing threat failed

500 — Version-creation prefetch failed (pro-user edit path)

500 — Save proposed changes failed (pro-user edit path)

500 — Admin/editor threat update failed

500 — Admin/editor threat details update failed

500 — Catch-all

cURL example

​Request body

​Response examples

​Success (200)

​401 — No Authorization header

​401 — Invalid API token

​429 — IP rate limit (whitelisted IPs bypass)

​429 — Modification rate limit (per hour)

​405 — Method not allowed

​400 — No target identifier supplied

​404 — Lookup by package_name returned nothing

​404 — Lookup by resource_identifier returned nothing

​404 — threat_id not found

​500 — Lookup by package_name failed

​500 — Lookup by resource_identifier failed

​500 — Fetch existing threat failed

​500 — Version-creation prefetch failed (pro-user edit path)

​500 — Save proposed changes failed (pro-user edit path)

​500 — Admin/editor threat update failed

​500 — Admin/editor threat details update failed

​500 — Catch-all

​cURL example

Request body

Response examples

Success (200)

401 — No Authorization header

401 — Invalid API token

429 — IP rate limit (whitelisted IPs bypass)

429 — Modification rate limit (per hour)

405 — Method not allowed

400 — No target identifier supplied

404 — Lookup by `package_name` returned nothing

404 — Lookup by `resource_identifier` returned nothing

404 — `threat_id` not found

500 — Lookup by package_name failed

500 — Lookup by resource_identifier failed

500 — Fetch existing threat failed

500 — Version-creation prefetch failed (pro-user edit path)

500 — Save proposed changes failed (pro-user edit path)

500 — Admin/editor threat update failed

500 — Admin/editor threat details update failed

500 — Catch-all

cURL example