> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pull all threats links to a specific username

> Find all verified threats associated with a specific publisher or username in a given ecosystem.

The `query-by-username` endpoint returns all verified threats linked to a specific publisher or author username within an ecosystem.

<Note>
  Subscription Required: This is a paid endpoint available to Researcher Pro and Enterprise users.
</Note>

Use this endpoint to:

* **Investigate suspicious publishers:** Look up all known malicious packages associated with a specific npm publisher, PyPI author, or other ecosystem account.
* **Track threat actors:** Monitor whether a known malicious username has published additional packages across registries.
* **Enrich incident response:** Quickly surface all threats tied to a publisher identified during an active investigation.

**Endpoint**

```text theme={null}
GET https://api.opensourcemalware.com/functions/v1/query-by-username
```

**Required header**

```text theme={null}
Authorization: Bearer osm_your_token
```

Alternative: Pass API key as query parameter: `?apikey=osm_your_token`

## Query parameters

`ecosystem` is required. Package ecosystem (npm, pypi, rubygems, vscode, skills, etc.)

`username` is required. Publisher/author username to search for.

## Response examples

### Threats found

```json theme={null}
{
  "ecosystem": "npm",
  "username": "jasonsaayman",
  "threat_count": 1,
  "threats": [
    {
      "id": "efe675aa-e11e-4b60-9d49-a1f15e4c42f0",
      "created_at": "2026-03-31T19:23:50.312199+00:00",
      "updated_at": "2026-03-31T21:25:46.244+00:00",
      "report_type": "package",
      "registry": "npm",
      "resource_identifier": "npm/@c8o/nimbus-core",
      "package_name": "@c8o/nimbus-core",
      "severity_level": "critical",
      "status": "verified",
      "verified_at": "2026-03-31T21:25:46.244+00:00",
      "tags": [
        "data-exfiltration",
        "infostealer",
        "npm",
        "compromised-account",
        "sfrclak"
      ],
      "first_seen": "2026-03-31T19:23:47.793+00:00",
      "last_seen": null,
      "download_count": null,
      "version_info": "1.0.12",
      "submitted_by": "eda4f392-d4db-42bb-83be-d790cfa8ebe1",
      "updated_by": "31a529f3-2945-4ae9-9639-846ee75c8c3d",
      "source": null,
      "published_date": null,
      "source_id": null,
      "threat_description": "Malicious package detected. Behaviors: data exfiltration.",
      "evidence_references": null,
      "verified_by": "6mile",
      "researcher": null,
      "researcher_organization": null,
      "osv_advisory_url": "https://osv.dev/vulnerability/MAL-2026-2314",
      "ghsa_advisory_url": null,
      "domain_id": null,
      "search_tsv": "'c8o/nimbus-core':1A,3A 'npm':2A",
      "payload_description": "Payload: dist/index.cjs\nSecondary files: dist/index.esm\n\nKey findings:\n- Environment Variable Exfiltration in dist/index.cjs: \"process.env.PERMISSION_GET,\n  POST: process.env.PERMISSION_POST,\n  PATCH: proces...\"\n- Environment Variable Exfiltration in dist/index.esm: \"process.env.PERMISSION_GET,\n  POST: process.env.PERMISSION_POST,\n  PATCH: proces...\"\n\nIOCs:\n- payloadFileHash: 68456dda94ca47d999505e59c1118f31c23eb4ece715a03a0029e43c082d34a1",
      "publisher_email": "jasonsaayman@gmail.com",
      "malicious_dependencies": []
    }
  ]
}
```

### No threats

```json theme={null}
{
  "ecosystem": "npm",
  "username": "clean-user",
  "threat_count": 0,
  "threats": []
}
```

### 401 — Missing API token

```json theme={null}
{ "error": "Missing API token. Provide via Authorization header or apikey query parameter." }
```

### 401 — Invalid token

```json theme={null}
{ "error": "Invalid API token" }
```

### 401 — Inactive token

```json theme={null}
{ "error": "API token is inactive" }
```

### 403 — Requires Pro/Enterprise

```json theme={null}
{ "error": "Pro or Enterprise account required for this endpoint. Please contact an administrator at info@sourcecodered.com to request access." }
```

### 400 — Missing params

```json theme={null}
{
  "error": "Missing required parameters. Both ecosystem and username are required.",
  "example": "/query-by-username?ecosystem=npm&username=malicious-publisher"
}
```

### 500 — Failed to verify permissions

```json theme={null}
{ "error": "Failed to verify permissions" }
```

### 500 — Database query failed

```json theme={null}
{ "error": "Database query failed" }
```

## cURL example

```text theme={null}
curl -H "Authorization: Bearer osm_your_token" \
  "https://api.opensourcemalware.com/functions/v1/query-by-username?ecosystem=npm&username=suspicious-publisher"
```