Modify a threat report

The modify-threat-report endpoint lets you update a threat report, whether submitted by you or another community member. Only the fields you include in the request body will be changed. Fields you omit are left as-is. Use it to:

Add new evidence: Update a report with newly discovered IOCs, advisory URLs, or supporting references as your investigation develops.
Correct report details: Fix inaccurate severity assessments, version information, or payload descriptions after initial submission.
Expand threat coverage: Add tags, contributors, or updated publisher information as more becomes known about a threat actor or campaign.

Modified reports go through the community verification process before they are published to the database. This review ensures data quality and prevents false positives. You can track the status of your submissions from your profile on opensourcemalware.com.

Endpoint

PUT https://api.opensourcemalware.com/functions/v1/modify-threat-report

Required headers

Authorization: Bearer osm_your_token
Content-Type: application/json

Request body

Identify the report

Include one of these fields to identify the report you want to change:

Field	Description
`threat_id`	Recommended. The UUID of the report. It’s returned by submit-threat-report and in `details.threat_id` from check-malicious.
`package_name`	The package name. Optionally combine with `registry`.
`resource_identifier`	The resource identifier. Optionally combine with `registry`.

If you send more than one identifier, the API uses package_name first, then resource_identifier, then threat_id. A package_name or resource_identifier lookup that matches more than one report returns a 500 error. Send threat_id by itself to always target exactly one report.

Fields you can modify

Field	Type	Description
`threat_description`	string	What the malware does and why it’s dangerous. Can’t be cleared.
`payload_description`	string	Technical details of the malicious behavior. Supports Markdown.
`severity_level`	string	`"critical"` \| `"high"` \| `"medium"` \| `"low"` \| `"info"`
`version_info`	string	Affected versions, comma-separated.
`tags`	array	Replaces the report’s tags. See below.
`evidence_references`	string	URLs to supporting evidence, separated by semicolons (`;`) or newlines.
`publisher`	string	Username or organization that published the asset.
`osv_advisory_url`	string	Link to an OSV advisory.
`ghsa_advisory_url`	string	Link to a GitHub Security Advisory.

Fields you can’t change

report_type, resource_identifier, package_name, and registry can’t be changed with this endpoint. If one of them is wrong, contact us.

How updates are applied

Only the fields you include are changed. Leave out any field you don’t intend to change.
tags and contributors replace the stored list. They aren’t merged. To add a tag, send the full list: the existing tags plus the new one.
Sending an empty string (""), null, or an empty array ([]) clears that field.

Response examples

Success: all other accounts (200)

The change is saved as a proposed revision for review.

{
  "message": "Proposed changes saved for admin review. The current threat report remains visible.",
  "threat_id": "123e4567-e89b-12d3-a456-426614174000",
  "version_number": 1,
  "status": "pending_review"
}

Errors

API error responses

Click this card for the latest list of error responses.

cURL example

{
  "threat_id": "123e4567-e89b-12d3-a456-426614174000",
  "severity_level": "critical",
  "payload_description": "Downloads both a cryptocurrency miner and a keylogger.",
  "tags": ["npm", "cryptominer", "postinstall", "keylogger"]
}

Because tags replaces the existing list, this example sends the report’s existing tags (npm, cryptominer, postinstall) plus the new keylogger tag.

Overview

Free Endpoints

Paid Endpoints

Request body

Identify the report

Fields you can modify

Fields you can’t change

How updates are applied

Response examples

Success: all other accounts (200)

Errors

API error responses

cURL example

​Request body

​Identify the report

​Fields you can modify

​Fields you can’t change

​How updates are applied

​Response examples

​Success: all other accounts (200)

​Errors

API error responses

​cURL example

Request body

Identify the report

Fields you can modify

Fields you can’t change

How updates are applied

Response examples

Success: all other accounts (200)

Errors

cURL example