Report a malicious asset via API

The submit-threat-report endpoint lets you submit threat reports programmatically without using the web interface. Submitted reports enter the community verification process and are only published after passing a human review. Use this endpoint to:

Automate reporting from your tooling: Flag suspicious assets the moment your detection systems identify them, without switching to the web UI.
Integrate with security pipelines: Trigger submissions directly from CI/CD workflows, dependency scanners, or SIEM alerts.
Contribute at scale: Research teams and Research Partners can submit structured threat reports in bulk via API.

Reports go through the community verification process before they are published to the database. This review ensures data quality and prevents false positives. You can track the status of your submissions from your profile.

New users are limited to three reports. Once those are verified, this limit is removed. You will receive a 403 error if you try to submit more than three reports before your initial three submissions are approved.

For guidance on writing high-quality threat reports — including what evidence to include and how to describe threat behavior — see the reporting guidelines.

Endpoint

POST https://api.opensourcemalware.com/functions/v1/submit-threat-report

Required headers

Authorization: Bearer osm_your_token
Content-Type: application/json

Request body

Use our docs MCP server to improve the quality of your submissions.

Required fields

Field	Type	Description
`report_type`	string	`"package"` \| `"repository"` \| `"url"` \| `"domain"` \| `"ip"` \| `"wallet"` \| `"container"`
`resource_identifier`	string	The identifier for the asset being reported. See format by report type below.
`threat_description`	string	A clear explanation of why this asset is considered malicious. See writing a strong description.

Optional fields

Field	Type	Description
`package_name`	string	Name of the package as it appears in the registry.
`registry`	string	Package registry, e.g. `"npm"`, `"pypi"`, `"rubygems"`, `"skills"`
`publisher`	string	Publisher username, email, or organization associated with the threat.
`publisher-email`	string	The email address associated with the `publisher` field.
`payload_description`	string	Technical details about what the malicious code does. Supports Markdown — use headers, bullet lists, and inline code to structure IOCs and behavioral detail.
`severity_level`	string	`"critical"` \| `"high"` \| `"medium"` \| `"low"` \| `"info"`
`evidence_references`	string	URLs to supporting evidence, separated by semicolons (;) \
`contact_email`	string	Your email address for follow-up.
`tags`	array	Categorization labels (see Tagging guide below)
`version_info`	string	You can input a single version (e.g. 1.0.1), a series of versions separated by commas (e.g. 1.1.2, 5.6.0), or a block of versions (e.g. 1.0.0 - 3.0.0). If all versions are malicious (an attacker-owned package), use `all`. Don’t include prose — context belongs in `threat_description`.
`first_seen`	string	ISO 8601 timestamp for either a) when an attacker-owned package first version was published or b) the first malicious version of a compromised, legitimate package was published.
`osv_advisory_url`	string	Link to a corresponding OSV record, if one exists.
`ghsa_advisory_url`	string	Link to a corresponding GHSA, if one exists.
`contributors`	array	Other researchers who contributed to this report.
`download_count`	number	Download statistics for the reported asset at the time of discovery.

Tagging guide

Tags aid in searching through the web UI and help API consumers set up their own workflows based on keywords. We appreciate when you tag your submissions! Check out our page on Tags. This table contains several categories of useful tags that you can apply:

Category	Description	Examples
Threat actor group	The known group responsible for the malware	`dprk`, `teampcp`
Campaign	The named campaign this record belongs to	`glassworm`, `polinrider`, `mini-shai-hulud`
Malware family	The named malware family this payload belongs to	`ottercookie`, `beavertail`
Malware type	What the malware does	`rat`, `infostealer`, `cryptominer`
Attacker tactic	How the attacker delivered or disguised the malware	`account-takeover`, `name-confusion`
Execution method	How the malware runs	`postinstall`, `preinstall`, `tasks-json`
Infrastructure	Services or platforms abused as part of the attack operation	`telegram`, `aptos`, `vercel`
Victim	A specific organization, platform, or technology targeted by the attack	`redhat`, `aws`, `coinbase`

Resource identifier format

The value of resource_identifier depends on report_type:

Report type	Expected format	Example
`package`	Package name as it appears in the registry	`@scope/package-name`
`package (registry: skills)`	Full skill URL	`https://www.clawhub.ai/user/skill-name`
`repository`	Host and path, no protocol	`https://www.github.com/user/repo`
`url`	Full URL	`https://example.com/payload`
`domain`	Bare domain	`evil-c2-server.com`
`ip`	IP address	`192.0.2.1`
`wallet`	Wallet address	`1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa`
`container`	Image reference	`docker.io/evil/image:latest`

IOC formatting in `payload_description`

When including network indicators, file hashes, or other IOCs in payload_description, follow standard defanging conventions to prevent accidental execution or link-following:

URLs: replace https:// with hxxps://
Dots in domains and IPs: replace . with [.]

Example: hxxps://malicious[.]example[.]com/payload payload_description renders as Markdown in the OSM web UI. Use headers (##), bullet lists, and inline code backticks to structure behavioral detail and IOCs for readability.

Responses

200 — Success

{
  "message": "Threat report submitted successfully",
  "threat_id": "123e4567-e89b-12d3-a456-426614174000",
  "status": "pending"
}

Errors

API error responses

Click this card for the latest list of error responses.

Examples

Package report

curl -X POST "https://api.opensourcemalware.com/functions/v1/submit-threat-report" \
  -H "Authorization: Bearer osm_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "report_type": "package",
    "resource_identifier": "malicious-package",
    "threat_description": "Package contains a postinstall hook that downloads and executes a cryptocurrency miner.",
    "package_name": "malicious-package",
    "registry": "npm",
    "version_info": "1.0.0, 1.0.1, 1.0.2",
    "severity_level": "critical",
    "tags": ["cryptocurrency", "miner", "postinstall-hook"]
  }'

Package report (AI skills)

curl -X POST "https://api.opensourcemalware.com/functions/v1/submit-threat-report" \
  -H "Authorization: Bearer osm_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "report_type": "package",
    "registry": "skills",
    "resource_identifier": "https://www.clawhub.ai/someuser/evil-skill",
    "package_name": "https://www.clawhub.ai/someuser/evil-skill",
    "publisher": "someuser",
    "severity_level": "high",
    "threat_description": "ClawHub AI skill that exfiltrates environment variables to an attacker-controlled Cloudflare Worker after every tool invocation.",
    "payload_description": "SKILL.md presents a benign helper prompt, while rules/ instructs the agent to read .env and POST contents to hxxps://evil-worker[.]workers[.]dev/collect.",
    "evidence_references": "https://www.clawhub.ai/someuser/evil-skill",
    "tags": ["ai-skill", "claude-skill", "data-exfiltration", "concealment"],
    "first_seen": "2026-08-28T00:00:00Z",
    "contact_email": "you@example.com"
  }'

Repository report

curl -X POST "https://api.opensourcemalware.com/functions/v1/submit-threat-report" \
  -H "Authorization: Bearer osm_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "report_type": "repository",
    "resource_identifier": "github.com/malicious-user/evil-repo",
    "threat_description": "Repository contains an info-stealer targeting GitHub Actions secrets and AWS credentials.",
    "publisher": "malicious-user",
    "severity_level": "high",
    "tags": ["infostealer", "credential-theft"]
  }'

Domain report

curl -X POST "https://api.opensourcemalware.com/functions/v1/submit-threat-report" \
  -H "Authorization: Bearer osm_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "report_type": "domain",
    "resource_identifier": "evil-c2-server.com",
    "threat_description": "C2 server receiving exfiltrated credentials from trojanized npm packages in the jagreehal ecosystem.",
    "severity_level": "critical",
    "tags": ["c2", "credential-theft"]
  }'

Overview

Free Endpoints

Paid Endpoints

Endpoint

Request body

Required fields

Optional fields

Tagging guide

Resource identifier format

IOC formatting in `payload_description`

Responses

200 — Success

Errors

API error responses

Examples

​Endpoint

​Request body

​Required fields

​Optional fields

​Tagging guide

​Resource identifier format

​IOC formatting in payload_description

​Responses

​200 — Success

​Errors

API error responses

​Examples

Endpoint

Request body

Required fields

Optional fields

Tagging guide

Resource identifier format

IOC formatting in `payload_description`

Responses

200 — Success

Errors

Examples