Introducing SafeDep Threat Intel

• Sep 8, 2026 • 1 min read

SafeDep Threat Intel is now available as an add-on to any paid plan.

It gives SOC and cyber defense teams the malicious package intelligence behind SafeDep’s platform. They can query it, or push it into the tools they already run to protect against supply chain attacks in their network.

Check out the 📑 Documentation

What’s in it?

Malicious package feed API. A continuous stream of suspicious and confirmed malicious packages, campaigns, and indicators of compromise (IoCs) across npm, PyPI, Go, Maven, and more.

1
export SAFEDEP_API_KEY="<your-api-key>"
2
export SAFEDEP_TENANT_ID="your-company.safedep.io"
3
export TI="https://api.safedep.io/safedep.services.threatintel.v1.ThreatIntelService"
4

5
curl -sS "$TI/ListPackageReports" \
6
  -H "Content-Type: application/json" \
7
  -H "Authorization: $SAFEDEP_API_KEY" \
8
  -H "X-Tenant-ID: $SAFEDEP_TENANT_ID" \
9
  -d '{"pagination":{"pageSize":5,"sortOrder":"SORT_ORDER_DESCENDING"}}'

SafeDep Threat Intel Dashboard. A curated place for all verdicts, reasoning, and campaigns in the SafeDep console.

Package Verdict Feed

Threat Intel dashboard listing malicious package verdicts

Package Verdict Details

Verdict detail panel for a single malicious package

Campaigns

Campaign view grouping related malicious packages

🚀 Quickstart with SafeDep Threat Intel

Support

Contact us via email, Discord and other channels.

threat-intelligence
malware
supply-chain
secops

Author

Kunal Singh

safedep.io

Share

Security

MALFEX Moves Its npm Loader into a Native Windows DLL

The MALFEX package imgdecode contains a native Windows loader. When loaded from a console, it attempts to download, decrypt, and inject shellcode into dllhost.exe.

Malware

tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud

[email protected] on npm ran a Mini Shai-Hulud worm at install. A maintainer account committed the payload through the GitHub web interface, and the official release workflow published it.

Security

ASOS App Hack: Attackers Used Push Notifications to Send a Ransom Note

Attackers got into the platforms ASOS uses to message customers and pushed an extortion note to phones. Here is what is confirmed, what is only claimed, and what customers should do.

Security

42 Malicious RubyGems Open a Reverse Shell at Install Time

One RubyGems account published 42 gems that run code during gem install. On a developer workstation, the gems open a reverse shell or download a second stage. They do nothing on CI runners and...