Skip to main content

​
Report

A package report is the feed’s record of one malicious package. It carries the verdict, the affected versions, the indicators, and any campaign the package belongs to. A group of related packages is a campaign, not a report. Each report has a permanent reportId. SafeDep updates the same report as it learns more (a verdict upgrade, new indicators, or a withdrawal) and never deletes it, so its reportId tracks one threat over time.

​
Verdict and confidence

The verdict is what SafeDep believes about the package. The confidence is who decided it. A suspicious report can become malicious later. This is a change, so the report comes back on the change feed.

​
Withdrawn

SafeDep can retract a report, for example a false positive or a report dropped after review. The field withdrawn: true marks it. SafeDep does not delete a withdrawn report, so you see the retraction and can remove it on your side too.

​
Indicator of compromise

An indicator (IOC) is a typed observable on a report or a campaign. For example, a command-and-control domain, a file hash, a maintainer handle, or a wallet address. Its identity is the pair (type, value). See the schema reference for the IndicatorType values. Today, indicators travel inside each report (iocs) and each campaign. A direct pull of indicators is planned but not available yet.

​
Campaign

A campaign is a named group of related reports that share an actor, a technique, or one coordinated intent. SafeDep researchers curate campaigns, each with its own indicators, counts, and actor attribution. The feed serves only active campaigns. Once a campaign is archived or withdrawn, it drops out of the feed.

​
Change feed and cursor

Reports and campaigns come back when they change. A change cursor orders them. This is how you keep a local mirror in sync.
  • A report comes back when its verdict, indicators, or campaign links change. Its cursor is (updatedAt, reportId). updatedAt moves only on a real change, never on a no-op refresh.
  • A campaign comes back when it changes, for example when a member report is added or removed. Its cursor is (lastActivityAt, campaignId).
Keep the default ascending order and store the highest cursor value you have seen; that is your at-least-once change stream. Process a report again each time it returns, keyed by reportId. See Pagination & sync.