Query latest threats by ecosystem

The query-latest endpoint pulls the most recent verified threats (up to 100) added to the database for a given ecosystem. This is a free endpoint available to all authenticated users. Use this endpoint to:

Monitor recent threats in your ecosystem: Poll this endpoint on a schedule to stay current on new verified threats in the registries your organization depends on.
Build real-time security dashboards: Feed the response into an internal dashboard to give your security team visibility into emerging supply chain threats as they are verified.
Automate security scanning: Integrate the endpoint into CI/CD pipelines or dependency scanning workflows to flag newly verified threats against packages in your environment.
Research attack patterns: Pull recent threats to analyze trends in attacker behavior, targeting patterns, or payload types across ecosystems.

Use the /query-latest endpoint to pull the most recent verified threats added to the database for a given ecosystem. The endpoint returns up to 100 records per request, ordered by most recently added. This is a free endpoint available to all authenticated users. Endpoint

GET https://api.opensourcemalware.com/functions/v1/query-latest

Required header

Authorization: Bearer osm_your_token

Alternative: Pass API key as query parameter: ?apikey=osm_your_token

Query parameters

An ecosystem string (package ecosystem or threat type) is required. Valid values for packages: npm, pypi, crates, nuget, maven, go, packagist, rubygems, vscode, openvsx, brew, and skills. Valid values for other malicious assets: repository andcontainer. Not supported: domain, wallet, ip, url.

Response example

Success (200)

{
  "ecosystem": "npm",
  "count": 100,
  "threats": [
    {
      "id": "c657f9f3-a270-44ee-8fc3-e986d282d132",
      "created\_at": "2026-06-20T02:24:23.546471\+00:00",
      "updated\_at": "2026-06-20T22:06:54.468\+00:00",
      "report\_type": "package",
      "severity\_level": "high",
      "status": "verified",
      "verified\_at": "2026-06-20T22:06:54.468\+00:00",
      "first\_seen": "2026-06-20T02:24:19.87\+00:00",
      "last\_seen": null,
      "registry": "npm",
      "resource\_identifier": "npm/new-eslint-1",
      "package\_name": "new-eslint-1",
      "download\_count": null,
      "published\_date": null,
      "tags": \[
        "npm",
        "compromised-account",
        "entry-main",
        "suspicious-metadata",
      \],
      "version\_info": "7.0.6",
      "source\_id": null,
      "threat\_description": "Malicious package detected.",
      "payload\_description": "ENTRY\\n  big.mjs (main: big.mjs)\\n\\nADDITIONAL FINDINGS\\n  - Very New NPM Publisher Account\\n  - Publisher Has Other Malicious Packages\\n  - Publisher Shows Burner-Account Pattern\\n\\nINDICATORS (IOCs)\\n  - urls: [http://mikemcl.github.io/big.js/](http://mikemcl.github.io/big.js/), [https://deno.land/](https://deno.land/), [https://www.coinbase.com/\\n](https://www.coinbase.com/\n)  - domains: [mikemcl.github.io](http://mikemcl.github.io), [www.coinbase.com](http://www.coinbase.com), [deno.land](http://deno.land)\\n  - emails: start@yc.length, adding@yc.length",
      "evidence\_references": null,
      "verified\_by": "6mile",
      "osv\_advisory\_url": "[https://osv.dev/vulnerability/MAL-2026-6225](https://osv.dev/vulnerability/MAL-2026-6225)",
      "ghsa\_advisory\_url": null,
      "researcher": null,
      "researcher\_organization": null,
      "malicious\_dependencies": \[\]
    }
  \]
}

Depending on how you’ve integrated the API, you may see a blank version_info field or a null response. This indicates that all versions are malicious, which is common with malicious assets.

401 — Missing API token

{ "error": "API token required. Provide it via Authorization header (Bearer token) or apikey query parameter." }

401 — Invalid token

{ "error": "Invalid API token" }

401 — Inactive token

{ "error": "API token is inactive" }

400 — Missing `ecosystem`

{ "error": "ecosystem parameter is required" }

500 — Query failed

{ "error": "Failed to query threats" }

cURL example

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/query-latest?ecosystem=npm"

Overview

Free Endpoints

Paid Endpoints

Query parameters

Response example

Success (200)

401 — Missing API token

401 — Invalid token

401 — Inactive token

400 — Missing `ecosystem`

500 — Query failed

cURL example

​Query parameters

​Response example

​Success (200)

​401 — Missing API token

​401 — Invalid token

​401 — Inactive token

​400 — Missing ecosystem

​500 — Query failed

​cURL example

Query parameters

Response example

Success (200)

401 — Missing API token

401 — Invalid token

401 — Inactive token

400 — Missing `ecosystem`

500 — Query failed

cURL example