Retrieve detailed threat metadata including IOCs

The threat-data endpoint returns the full threat record for a verified threat, including all associated IOCs. Pass a threat_id from a check-malicious response to retrieve the complete intelligence for that threat.

Subscription Required: This is a paid endpoint. Check out our pricing and contact us for more info.

Use this endpoint to:

Retrieve IOCs for blocking and detection: Pull all indicators associated with a threat to feed into your firewall rules, SIEM detections, or EDR policies.
Enrich threat reports: Get the full threat description, severity, tags, and IOC list for a package flagged during dependency scanning.
Power automated response: Integrate into incident response workflows to automatically retrieve and act on threat intelligence when a malicious resource is detected.

Endpoint

GET https://api.opensourcemalware.com/functions/v1/threat-data

Required header

Authorization: Bearer osm_your_token

Pro or Enterprise required This endpoint is restricted to users with Pro or Enterprise roles. Standard API tokens will receive a 403 Forbidden response.

Query parameters

threat_id is required. UUID of the threat to retrieve (e.g. from a check-malicious response).

Response examples

Success (200)

{
  "threat_id": "a5b0c00a-f2db-4f4a-87fd-ff62882d20bf",
  "package_name": "axios",
  "registry": "npm",
  "report_type": "package",
  "severity_level": "critical",
  "threat_description": "Legitimate axios npm package compromised via hijacked maintainer account. Malicious versions 1.14.1 and 0.30.4 were published by an attacker who changed the maintainer email to ifstap@proton.me. The compromised package contacts a C2 server and drops platform-specific RAT payloads (macOS, Windows, Linux). After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection.",
  "osm_url": "https://opensourcemalware.com/npm/axios",
  "iocs": [
    {
        "ioc_type": "url",
        "value": "http://sfrclak.com:8000/6202033",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "domain",
        "value": "sfrclak.com",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "ip_address",
        "value": "142.11.206.73",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09",
        "confidence_level": "high",
        "description": "plain-crypto-js setup.js stage 1 javascript sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a",
        "confidence_level": "high",
        "description": "stage 2 mac binary sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101",
        "confidence_level": "high",
        "description": "stage 2 windows binary sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf",
        "confidence_level": "high",
        "description": "stage 2 linux python .py sha256 hash"
    }
  ],
  "ioc_count": 7,
  "inherited_iocs": [],
  "malicious_dependencies": [
    {
        "threat_id": "c23da496-61ec-491c-b35d-98941d5238c1",
        "package_name": "plain-crypto-js",
        "resource_identifier": "npm/plain-crypto-js",
        "registry": "npm",
        "depth": 1
    }
  ]
}

Errors

API error responses

Click this card for the latest list of error responses.

cURL example

curl -X GET "https://api.opensourcemalware.com/functions/v1/threat-data?threat_id=YOUR_THREAT_UUID" \
  -H "Authorization: Bearer osm_your_token"

Typical workflow

Use check-malicious to check if a package/resource is malicious and get the threat_id from the response
Pass the threat_id to threat-data to retrieve the full threat description and all IOCs
Use the IOCs for automated blocking, detection rules, or threat hunting in your environment

Overview

Free Endpoints

Paid Endpoints

Retrieve detailed threat metadata including IOCs

Query parameters

Response examples

Success (200)

Errors

API error responses

cURL example

Typical workflow

​Query parameters

​Response examples

​Success (200)

​Errors

API error responses

​cURL example

​Typical workflow

Query parameters

Response examples

Success (200)

Errors

cURL example

Typical workflow