> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to report threats

> Learn what threat reporting is, who can submit reports, what resource types are covered, and what information to include in a submission.

Threat reporting is how the OpenSourceMalware community shares information about malicious packages, repositories, and infrastructure. When you submit a report, you contribute directly to a shared database that security teams, developers, and automated tools rely on to block and research threats across the open-source ecosystem. Every verified report you submit adds to your community profile and earns you recognition as a contributor.

## Who can submit reports

Any registered user can submit a threat report. Sign in at [opensourcemalware.com/auth](https://opensourcemalware.com/auth) to get started (please note, you must [contact us](https://opensourcemalware.com/contact) to sign up via email). Your profile is used to verify your identity and track your contributions over time.

Threat reports can be submitted through the web interface at [opensourcemalware.com/report](https://opensourcemalware.com/report) or programmatically via the [submit-threat API endpoint](/api/submit-threat).

<Warning>
  Reports flagged as false positives are tracked on your profile. Take time to confirm a threat is genuinely malicious before submitting.
</Warning>

## What you can report

OpenSourceMalware accepts reports across a broad range of resource types. The one rule? All reports must relate to the delivery of malicious open source.

<CardGroup cols={2}>
  <Card title="Packages" icon="box">
    Malicious packages on npm, PyPI, Maven, NuGet, RubyGems, Packagist, Crates.io, Go Modules, VS Code Marketplace, Open VSX, and AI Skills registries.
  </Card>

  <Card title="Container images" icon="docker">
    Malicious container images on Docker Hub, GitHub Container Registry (GHCR), Quay, and other registries.
  </Card>

  <Card title="Repositories" icon="code-branch">
    GitHub, GitLab, and Bitbucket repositories that contain malicious code or serve as staging infrastructure for payload distribution.
  </Card>

  <Card title="Domains & URLs" icon="globe">
    Command-and-control (C2) servers, phishing domains, and specific malicious URLs used to deliver payloads or exfiltrate data.
  </Card>

  <Card title="IP addresses" icon="network-wired">
    Malicious IP addresses tied to C2 infrastructure, attack sources, and known threat actor networks.
  </Card>

  <Card title="Crypto wallets" icon="wallet">
    Cryptocurrency wallet addresses embedded in malicious payloads as a covert channel to relay commands or exfiltrate data.
  </Card>
</CardGroup>

## What to include in a submission

The submission form collects two categories of information:

* Required fields that must be present for a report to enter review
* Recommended fields that significantly improve review speed and accuracy

### Required fields

| Field                   | Description                                                                                                    |
| ----------------------- | -------------------------------------------------------------------------------------------------------------- |
| **Report type**         | The resource category: package, repository, URL, domain, IP, wallet, or container.                             |
| **Resource identifier** | The package name, full URL, domain, IP address, wallet address, or image reference that identifies the threat. |
| **Threat description**  | A clear explanation of the malicious behavior, written so reviewers and other users can understand the risk.   |

### Recommended fields

| Field                     | Description                                                                          |
| ------------------------- | ------------------------------------------------------------------------------------ |
| **Severity**              | Critical, High, Medium, Low, or Informational.                                       |
| **Affected versions**     | Specific versions or ranges where the malicious behavior is present (packages only). |
| **Tags**                  | Categorization labels such as `backdoor`, `crypto-stealer`, or `typosquatting`.      |
| **Evidence URLs**         | Links to OSV/GHSA advisories, analysis blog posts, or security reports.              |
| **Payload description**   | Technical details about what the malicious code or behavior actually does.           |
| **Publisher information** | The author username, email address, or organization behind the resource.             |

## Updating reports

Anyone can update on any threat record - whether you submitted the original report or it was done by someone else. This is helpful when new information is available about the malicious asset, such as IOCs or threat actor attribution. Updates go through the same approval process as the initial report to ensure data quality remains high.

Approved threat record updates also give you points on the [Security Researcher Leaderboard](/community/points-reputation) (at a lower point value than submitting the report itself).

## Next steps

<CardGroup cols={2}>
  <Card title="Reporting guidelines" icon="book-open" href="/reporting/guidelines">
    Best practices for writing high-quality reports that pass review the first time.
  </Card>

  <Card title="Verification process" icon="shield-check" href="/reporting/verification-process">
    How the community reviews submissions and what happens after you submit.
  </Card>
</CardGroup>