Threat Intel

Malicious package intelligence
for security operations

The feed behind SafeDep's verdicts: confirmed malicious packages, the campaigns they belong to, and the indicators they leave behind. Query it, or push it into the tools your team already runs.

Book a Demo Read the Docs

Available as an add-on to any paid plan. See pricing →

npm
PyPI
Go
Maven
and more

10,000+

Malicious Packages Detected

5000+

Projects Protected

2M+

Packages Scanned

14hr

Avg Detection Lead

10,000+

Malicious Packages Detected

5000+

Projects Protected

2M+

Packages Scanned

14hr

Avg Detection Lead

See it in action

Threat Intel, end to end

A walkthrough of the console and the API, using live malicious packages caught by SafeDep.

The verdict feed, filtered by verdict and ecosystem
The evidence behind one verdict, down to the published bytes
Campaigns that group related packages under one operation
The same records pulled through the API

Read the docs Read the announcement →

In the console

Every verdict carries

its evidence

Threat Intel ships as a feed in the SafeDep console. Analysts read the reasoning and copy indicators without leaving the page.

Suspicious and confirmed malicious packages, newest first. Narrow the list by verdict or by ecosystem.

Threat Intel verdict feed listing malicious npm packages with verdict, indicator count and update time

Screenshots from the SafeDep console. Open the console →

API access

One endpoint your pipeline polls

Reports, indicators and campaigns as JSON. Filter by ecosystem, verdict, or the timestamp of your last pull.

Plain JSON over HTTP, and gRPC on the same endpoint
Pull only what changed since your last sync
Withdrawn reports are marked, never silently dropped

Quickstart Campaigns, filters and sync →

export API="https://api.safedep.io"
export SVC="safedep.services.threatintel.v1.ThreatIntelService"

curl -sS "$API/$SVC/ListPackageReports" \
  -H "Content-Type: application/json" \
  -H "Authorization: $SAFEDEP_API_KEY" \
  -H "X-Tenant-ID: $SAFEDEP_TENANT_ID" \
  -d '{"pagination":{"pageSize":20}}'

{
  "packageReports": [
    {
      "reportId": "01JZ8Q9V6K3S2M7C1B0A4E5F6G",
      "verdict": "THREAT_VERDICT_MALICIOUS",
      "confidence": "THREAT_CONFIDENCE_HUMAN_VERIFIED",
      "ecosystem": "ECOSYSTEM_NPM",
      "package": { "purl": "pkg:npm/[email protected]" },
      "iocs": [{ "type": "INDICATOR_TYPE_C2_DOMAIN", "value": "exfil.example.com" }],
      "campaigns": [{ "name": "npm crypto-stealer wave" }],
      "updatedAt": "2026-08-12T10:01:44Z"
    }
  ],
  "pagination": { "nextPageToken": "..." }
}