Query latest threats by ecosystem

The query-latest endpoint pulls the most recent verified threats (up to 100) added to the database for a given ecosystem. This is a free endpoint available to all authenticated users. Use this endpoint to:

Monitor recent threats in your ecosystem: Poll this endpoint on a schedule to stay current on new verified threats in the registries your organization depends on.
Build real-time security dashboards: Feed the response into an internal dashboard to give your security team visibility into emerging supply chain threats as they are verified.
Automate security scanning: Integrate the endpoint into CI/CD pipelines or dependency scanning workflows to flag newly verified threats against packages in your environment.
Research attack patterns: Pull recent threats to analyze trends in attacker behavior, targeting patterns, or payload types across ecosystems.

Use the /query-latest endpoint to pull the most recent verified threats added to the database for a given ecosystem. The endpoint returns up to 100 records per request, ordered by most recently added. This is a free endpoint available to all authenticated users.

This is the free version of threat-feed. If you have a subscription, use that API instead for a better experience.

Endpoint

GET https://api.opensourcemalware.com/functions/v1/query-latest

Required header

Authorization: Bearer osm_your_token

Alternative: Pass API key as query parameter: ?apikey=osm_your_token

Query parameters

An ecosystem string (package ecosystem or threat type) is required. Valid values for packages: npm, pypi, crates, nuget, maven, go, packagist, rubygems, vscode, openvsx, brew, and skills. Valid values for other malicious assets: repository andcontainer. Not supported: domain, wallet, ip, url.

Response example

Success (200)

{
  "ecosystem": "npm",
  "count": 100,
  "threats": [
    {
      "id": "c657f9f3-a270-44ee-8fc3-e986d282d132",
      "created\_at": "2026-06-20T02:24:23.546471\+00:00",
      "updated\_at": "2026-06-20T22:06:54.468\+00:00",
      "report\_type": "package",
      "severity\_level": "high",
      "status": "verified",
      "verified\_at": "2026-06-20T22:06:54.468\+00:00",
      "first\_seen": "2026-06-20T02:24:19.87\+00:00",
      "last\_seen": null,
      "registry": "npm",
      "resource\_identifier": "npm/new-eslint-1",
      "package\_name": "new-eslint-1",
      "download\_count": null,
      "published\_date": null,
      "tags": \[
        "npm",
        "compromised-account",
        "entry-main",
        "suspicious-metadata",
      \],
      "version\_info": "7.0.6",
      "source\_id": null,
      "threat\_description": "Malicious package detected.",
      "payload\_description": "ENTRY\\n  big.mjs (main: big.mjs)\\n\\nADDITIONAL FINDINGS\\n  - Very New NPM Publisher Account\\n  - Publisher Has Other Malicious Packages\\n  - Publisher Shows Burner-Account Pattern\\n\\nINDICATORS (IOCs)\\n  - urls: [http://mikemcl.github.io/big.js/](http://mikemcl.github.io/big.js/), [https://deno.land/](https://deno.land/), [https://www.coinbase.com/\\n](https://www.coinbase.com/\n)  - domains: [mikemcl.github.io](http://mikemcl.github.io), [www.coinbase.com](http://www.coinbase.com), [deno.land](http://deno.land)\\n  - emails: start@yc.length, adding@yc.length",
      "evidence\_references": null,
      "verified\_by": "6mile",
      "osv\_advisory\_url": "[https://osv.dev/vulnerability/MAL-2026-6225](https://osv.dev/vulnerability/MAL-2026-6225)",
      "ghsa\_advisory\_url": null,
      "researcher": null,
      "researcher\_organization": null,
      "malicious\_dependencies": \[\]
    }
  \]
}

Depending on how you’ve integrated the API, you may see a blank version_info field or a null response. This indicates that all versions are malicious, which is common with malicious assets.

Errors

API error responses

Click this card for the latest list of error responses.

cURL example

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/query-latest?ecosystem=npm"

Overview

Free Endpoints

Paid Endpoints

Query parameters

Response example

Success (200)

Errors

API error responses

cURL example

​Query parameters

​Response example

​Success (200)

​Errors

API error responses

​cURL example

Query parameters

Response example

Success (200)

Errors

cURL example