Retrieve detailed threat metadata including IOCs

The threat-data endpoint returns the full threat record for a verified threat, including all associated IOCs. Pass a threat_id from a check-malicious response to retrieve the complete intelligence for that threat.

Subscription Required: This is a paid endpoint available to Researcher Pro and Enterprise users.

Use this endpoint to:

Retrieve IOCs for blocking and detection: Pull all indicators associated with a threat to feed into your firewall rules, SIEM detections, or EDR policies.
Enrich threat reports: Get the full threat description, severity, tags, and IOC list for a package flagged during dependency scanning.
Power automated response: Integrate into incident response workflows to automatically retrieve and act on threat intelligence when a malicious resource is detected.

Endpoint

GET https://api.opensourcemalware.com/functions/v1/threat-data

Required header

Authorization: Bearer osm_your_token

Pro or Enterprise required This endpoint is restricted to users with Pro or Enterprise roles. Standard API tokens will receive a 403 Forbidden response.

Query parameters

threat_id is required. UUID of the threat to retrieve (e.g. from a check-malicious response).

Response examples

Success (200)

{
  "threat_id": "a5b0c00a-f2db-4f4a-87fd-ff62882d20bf",
  "package_name": "axios",
  "registry": "npm",
  "report_type": "package",
  "severity_level": "critical",
  "threat_description": "Legitimate axios npm package compromised via hijacked maintainer account. Malicious versions 1.14.1 and 0.30.4 were published by an attacker who changed the maintainer email to ifstap@proton.me. The compromised package contacts a C2 server and drops platform-specific RAT payloads (macOS, Windows, Linux). After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection.",
  "osm_url": "https://opensourcemalware.com/npm/axios",
  "iocs": [
    {
        "ioc_type": "url",
        "value": "http://sfrclak.com:8000/6202033",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "domain",
        "value": "sfrclak.com",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "ip_address",
        "value": "142.11.206.73",
        "confidence_level": "high",
        "description": null
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09",
        "confidence_level": "high",
        "description": "plain-crypto-js setup.js stage 1 javascript sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a",
        "confidence_level": "high",
        "description": "stage 2 mac binary sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101",
        "confidence_level": "high",
        "description": "stage 2 windows binary sha256 hash"
    },
    {
        "ioc_type": "file_hash_sha256",
        "value": "fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf",
        "confidence_level": "high",
        "description": "stage 2 linux python .py sha256 hash"
    }
  ],
  "ioc_count": 7,
  "inherited_iocs": [],
  "malicious_dependencies": [
    {
        "threat_id": "c23da496-61ec-491c-b35d-98941d5238c1",
        "package_name": "plain-crypto-js",
        "resource_identifier": "npm/plain-crypto-js",
        "registry": "npm",
        "depth": 1
    }
  ]
}

401 — Missing API token

{ "error": "API token required. Provide token in Authorization header or apikey query parameter." }

401 — Invalid or inactive token

{ "error": "Invalid or inactive API token" }

403 — Requires Pro/Editor/Admin

{ "error": "Access denied. This endpoint requires Pro, Editor, or Admin access." }

400 — Missing `threat_id`

{ "error": "Missing required parameter: threat_id" }

400 — Invalid UUID

{ "error": "Invalid threat_id format. Must be a valid UUID." }

404 — Not found or not verified/modified

{ "error": "Threat not found or not in verified/modified status." }

cURL example

curl -X GET "https://api.opensourcemalware.com/functions/v1/threat-data?threat_id=YOUR_THREAT_UUID" \
  -H "Authorization: Bearer osm_your_token"

Typical workflow

Use check-malicious to check if a package/resource is malicious and get the threat_id from the response
Pass the threat_id to threat-data to retrieve the full threat description and all IOCs
Use the IOCs for automated blocking, detection rules, or threat hunting in your environment

For a complete working example, see the Check and enrich threats guide.

Overview

Free Endpoints

Paid Endpoints

Retrieve detailed threat metadata including IOCs

Query parameters

Response examples

Success (200)

401 — Missing API token

401 — Invalid or inactive token

403 — Requires Pro/Editor/Admin

400 — Missing `threat_id`

400 — Invalid UUID

404 — Not found or not verified/modified

cURL example

Typical workflow

​Query parameters

​Response examples

​Success (200)

​401 — Missing API token

​401 — Invalid or inactive token

​403 — Requires Pro/Editor/Admin

​400 — Missing threat_id

​400 — Invalid UUID

​404 — Not found or not verified/modified

​cURL example

​Typical workflow

Query parameters

Response examples

Success (200)

401 — Missing API token

401 — Invalid or inactive token

403 — Requires Pro/Editor/Admin

400 — Missing `threat_id`

400 — Invalid UUID

404 — Not found or not verified/modified

cURL example

Typical workflow