Pull all threats links to a specific username

The query-by-username endpoint returns all verified threats linked to a specific publisher or author username within an ecosystem.

Subscription Required: This is a paid endpoint. Check out our pricing and contact us for more info.

Use this endpoint to:

Investigate suspicious publishers: Look up all known malicious packages associated with a specific npm publisher, PyPI author, or other ecosystem account.
Track threat actors: Monitor whether a known malicious username has published additional packages across registries.
Enrich incident response: Quickly surface all threats tied to a publisher identified during an active investigation.

Endpoint

GET https://api.opensourcemalware.com/functions/v1/query-by-username

Required header

Authorization: Bearer osm_your_token

Alternative: Pass API key as query parameter: ?apikey=osm_your_token

Query parameters

ecosystem is required. Package ecosystem (npm, pypi, rubygems, vscode, skills, etc.) username is required. Publisher/author username to search for.

Response examples

Threats found

{
  "ecosystem": "npm",
  "username": "jasonsaayman",
  "threat_count": 1,
  "threats": [
    {
      "id": "efe675aa-e11e-4b60-9d49-a1f15e4c42f0",
      "created_at": "2026-03-31T19:23:50.312199+00:00",
      "updated_at": "2026-03-31T21:25:46.244+00:00",
      "report_type": "package",
      "registry": "npm",
      "resource_identifier": "npm/@c8o/nimbus-core",
      "package_name": "@c8o/nimbus-core",
      "severity_level": "critical",
      "status": "verified",
      "verified_at": "2026-03-31T21:25:46.244+00:00",
      "tags": [
        "data-exfiltration",
        "infostealer",
        "npm",
        "compromised-account",
        "sfrclak"
      ],
      "first_seen": "2026-03-31T19:23:47.793+00:00",
      "last_seen": null,
      "download_count": null,
      "version_info": "1.0.12",
      "submitted_by": "eda4f392-d4db-42bb-83be-d790cfa8ebe1",
      "updated_by": "31a529f3-2945-4ae9-9639-846ee75c8c3d",
      "source": null,
      "published_date": null,
      "source_id": null,
      "threat_description": "Malicious package detected. Behaviors: data exfiltration.",
      "evidence_references": null,
      "verified_by": "6mile",
      "researcher": null,
      "researcher_organization": null,
      "osv_advisory_url": "https://osv.dev/vulnerability/MAL-2026-2314",
      "ghsa_advisory_url": null,
      "domain_id": null,
      "search_tsv": "'c8o/nimbus-core':1A,3A 'npm':2A",
      "payload_description": "Payload: dist/index.cjs\nSecondary files: dist/index.esm\n\nKey findings:\n- Environment Variable Exfiltration in dist/index.cjs: \"process.env.PERMISSION_GET,\n  POST: process.env.PERMISSION_POST,\n  PATCH: proces...\"\n- Environment Variable Exfiltration in dist/index.esm: \"process.env.PERMISSION_GET,\n  POST: process.env.PERMISSION_POST,\n  PATCH: proces...\"\n\nIOCs:\n- payloadFileHash: 68456dda94ca47d999505e59c1118f31c23eb4ece715a03a0029e43c082d34a1",
      "publisher_email": "jasonsaayman@gmail.com",
      "malicious_dependencies": []
    }
  ]
}

Errors

API error responses

Click this card for the latest list of error responses.

cURL example

curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/query-by-username?ecosystem=npm&username=suspicious-publisher"

Overview

Free Endpoints

Paid Endpoints

Pull all threats links to a specific username

Query parameters

Response examples

Threats found

Errors

API error responses

cURL example

​Query parameters

​Response examples

​Threats found

​Errors

API error responses

​cURL example

Query parameters

Response examples

Threats found

Errors

cURL example