Skip to main content
The threat-feed endpoint returns verified threats added to the OSM database within a rolling time window. Poll it every hour with hours=1 to never miss a threat.
Subscription Required: This is a paid endpoint available to Researcher Pro and Enterprise users.
Use this endpoint to:
  • Keep blocklists current: Pull newly verified threats on a schedule and automatically update your block rules without manual review.
  • Power automated alerting: Feed new threats into your SIEM, SOAR, or internal alerting pipeline as they are verified.
  • Recover missed threats: Use a larger hours value (up to 24) to catch up after a poller outage without re-ingesting your entire threat history.
Endpoint
Required header
Alternative: Pass API key as query parameter: ?apikey=osm_your_token
Paid Access Required This endpoint requires a Core or Enterprise API key. Standard API tokens will receive a 403 Forbidden response.

​
Query parameters

ecosystem is required:
  • Valid values for packages: npm, pypi, crates, nuget, maven, go, packagist, rubygems, vscode, openvsx, brew, and skills.
  • Valid values for other malicious assets: repository andcontainer.
  • Not supported: domain, wallet, ip, url.
Optional parameters include: -hours let’s you select a look back window between 1 and 24 hours. If you don’t specify a value, the default is 1. For example, hours=6 returns all threats verified in the last 6 hours.
  • unverified provides threat submissions that haven’t been verified by the OpenSourceMalware team. See Get unverified scans for instructions.

​
Response example

​
Success (200)

Depending on how you’ve integrated the API, you may see a blank version_info field or a null response. This indicates that all versions are malicious, which is common with malicious assets.

​
401 — Missing API token

​
401 — Invalid or inactive token

​
403 — Requires Pro/Editor/Admin

​
400 — Missing threat_id

​
400 — Invalid UUID

​
404 — Not found or not verified/modified

​
cURL examples

Poll for npm threats in the last hour (default):
Get PyPI threats from the last 6 hours:
Get all repository threats from the last 24 hours:
  • Never miss a threat: Set up a cron job to call this endpoint every hour with hours=1. Each call returns all threats verified since the last poll.
  • Catch-up window: If your poller goes down, use a larger hours value (up to 24) to recover any missed threats.
  • No duplicates: Results are filtered by verified_at timestamp, so overlapping windows will return the same threats — deduplicate by threat id.

​
Get unverified scans

Verified threats are accurate, but they lag behind real-time scanning by however long human review takes. If you’d rather trade a small false-positive risk for the freshest possible signal, you can pull scan results directly from OpenSourceMalware’s detection pipeline before a researcher has confirmed them.
Blocking unconfirmed malware can result in sending false positives to your development team and can lead to loss of trust. Be thoughtful about how you use this capability. For example, consider creating a “suspicious asset” policy that requires a time-based hold on downloading the package while you wait for OpenSourceMalware to make a determination.
Add unverified=1 to any threat-feed request:

​
STIX format

The OSM API also supports returning threat feed data in STIX (Structured Threat Information Expression) format, making it compatible with threat intelligence platforms and SIEMs that consume STIX bundles. To request STIX output, contact info@osmsecurity.com for access details.
Combine the threat feed with your internal tooling to build automated alerting pipelines. For example, pull the feed on a schedule, diff it against your last known state, and trigger alerts or block-list updates only for new entries. This keeps your security controls current without requiring manual review of every new threat report.