Introducing SafeDep Threat Intel

• Sep 8, 2026 • 1 min read

SafeDep Threat Intel is now available as an add-on to any paid plan.

It gives SOC and cyber defense teams the malicious package intelligence behind SafeDep’s platform. They can query it, or push it into the tools they already run to protect against supply chain attacks in their network.

Check out the 📑 Documentation

What’s in it?

Malicious package feed API. A continuous stream of suspicious and confirmed malicious packages, campaigns, and indicators of compromise (IoCs) across npm, PyPI, Go, Maven, and more.

1
export SAFEDEP_API_KEY="<your-api-key>"
2
export SAFEDEP_TENANT_ID="your-company.safedep.io"
3
export TI="https://api.safedep.io/safedep.services.threatintel.v1.ThreatIntelService"
4

5
curl -sS "$TI/ListPackageReports" \
6
  -H "Content-Type: application/json" \
7
  -H "Authorization: $SAFEDEP_API_KEY" \
8
  -H "X-Tenant-ID: $SAFEDEP_TENANT_ID" \
9
  -d '{"pagination":{"pageSize":5,"sortOrder":"SORT_ORDER_DESCENDING"}}'

SafeDep Threat Intel Dashboard. A curated place for all verdicts, reasoning, and campaigns in the SafeDep console.

Package Verdict Feed

Threat Intel dashboard listing malicious package verdicts

Package Verdict Details

Verdict detail panel for a single malicious package

Campaigns

Campaign view grouping related malicious packages

🚀 Quickstart with SafeDep Threat Intel

Support

Contact us via email, Discord and other channels.

threat-intelligence
malware
supply-chain
secops

Author

Kunal Singh

safedep.io

Share

Malware

Deep-Live-Cam Supply Chain Attack: Technical Analysis

A malicious dependency in Deep-Live-Cam loads a clipboard hijacker. We trace the installation trigger, Telegraph delivery, and Windows and macOS persistence.

Malware

Mini Shai-Hulud Strikes Again: openapi-react-query-codegen

An attacker exploited a flawed GitHub Actions workflow to publish 10 malicious versions of @7nohe/openapi-react-query-codegen (671K downloads/month) via npm OIDC trusted publishing. The payload uses...

Malware

A malicious npm package hidden three dependencies deep: the ulid-xyz delivery chain

ulid-xyz is a remote access trojan we reported to OSV as MAL-2026-6672. It reached developers as a third-level transitive dependency of ioredis-xyz, a copy of the real Redis client planted in 28...

Malware

From YouTube Ad to Root: How a Fake TradingView Installer Delivers a macOS Stealer

A YouTube video ad impersonating TradingView delivered a fake .pkg installer. Inside: a self-healing LaunchAgent, an AES-encrypted V8 bytecode payload, and a Node.js MITM proxy trusted by a rogue...