> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Query latest threats by ecosystem

> Retrieve the 100 most recent verified threat reports from any supported ecosystem or threat category.

The `query-latest` endpoint pulls the most recent verified threats (up to 100) added to the  database for a given ecosystem. This is a free endpoint available to all authenticated users.

Use this endpoint to:

* **Monitor recent threats in your ecosystem:** Poll this endpoint on a schedule to stay current on new verified threats in the registries your organization depends on.
* **Build real-time security dashboards:** Feed the response into an internal dashboard to give your security team visibility into emerging supply chain threats as they are verified.
* **Automate security scanning:** Integrate the endpoint into CI/CD pipelines or dependency scanning workflows to flag newly verified threats against packages in your environment.
* **Research attack patterns:** Pull recent threats to analyze trends in attacker behavior, targeting patterns, or payload types across ecosystems.

Use the `/query-latest` endpoint to pull the most recent verified threats added to the database for a given ecosystem. The endpoint returns up to 100 records per request, ordered by most recently added. This is a free endpoint available to all authenticated users.

**Endpoint**

```text theme={null}
GET https://api.opensourcemalware.com/functions/v1/query-latest
```

**Required header**

```text theme={null}
Authorization: Bearer osm_your_token
```

Alternative: Pass API key as query parameter: `?apikey=osm_your_token`

## Query parameters

An **ecosystem** string (package ecosystem or threat type) is required.

Valid values for packages: `npm`, `pypi`, `crates`, `nuget`, `maven`, `go`, `packagist`, `rubygems`, `vscode`, `openvsx`, `brew`, and `skills`.

Valid  values for other malicious assets: `repository` and`container`.

Not supported: `domain`, `wallet`, `ip`, `url`.

## Response example

### Success (200)

```json theme={null}
{
  "ecosystem": "npm",
  "count": 100,
  "threats": [
    {
      "id": "c657f9f3-a270-44ee-8fc3-e986d282d132",
      "created\_at": "2026-06-20T02:24:23.546471\+00:00",
      "updated\_at": "2026-06-20T22:06:54.468\+00:00",
      "report\_type": "package",
      "severity\_level": "high",
      "status": "verified",
      "verified\_at": "2026-06-20T22:06:54.468\+00:00",
      "first\_seen": "2026-06-20T02:24:19.87\+00:00",
      "last\_seen": null,
      "registry": "npm",
      "resource\_identifier": "npm/new-eslint-1",
      "package\_name": "new-eslint-1",
      "download\_count": null,
      "published\_date": null,
      "tags": \[
        "npm",
        "compromised-account",
        "entry-main",
        "suspicious-metadata",
      \],
      "version\_info": "7.0.6",
      "source\_id": null,
      "threat\_description": "Malicious package detected.",
      "payload\_description": "ENTRY\\n  big.mjs (main: big.mjs)\\n\\nADDITIONAL FINDINGS\\n  - Very New NPM Publisher Account\\n  - Publisher Has Other Malicious Packages\\n  - Publisher Shows Burner-Account Pattern\\n\\nINDICATORS (IOCs)\\n  - urls: [http://mikemcl.github.io/big.js/](http://mikemcl.github.io/big.js/), [https://deno.land/](https://deno.land/), [https://www.coinbase.com/\\n](https://www.coinbase.com/\n)  - domains: [mikemcl.github.io](http://mikemcl.github.io), [www.coinbase.com](http://www.coinbase.com), [deno.land](http://deno.land)\\n  - emails: start@yc.length, adding@yc.length",
      "evidence\_references": null,
      "verified\_by": "6mile",
      "osv\_advisory\_url": "[https://osv.dev/vulnerability/MAL-2026-6225](https://osv.dev/vulnerability/MAL-2026-6225)",
      "ghsa\_advisory\_url": null,
      "researcher": null,
      "researcher\_organization": null,
      "malicious\_dependencies": \[\]
    }
  \]
}
```

Depending on how you've integrated the API, you may see a blank `version_info` field or a null response. This indicates that all versions are malicious, which is common with malicious assets.

### 401 — Missing API token

```json theme={null}
{ "error": "API token required. Provide it via Authorization header (Bearer token) or apikey query parameter." }
```

### 401 — Invalid token

```json theme={null}
{ "error": "Invalid API token" }
```

### 401 — Inactive token

```json theme={null}
{ "error": "API token is inactive" }
```

### 400 — Missing `ecosystem`

```json theme={null}
{ "error": "ecosystem parameter is required" }
```

### 500 — Query failed

```json theme={null}
{ "error": "Failed to query threats" }
```

## cURL example

```text theme={null}
curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/query-latest?ecosystem=npm"
```