Skip to main content
The SafeDep Threat Intel Feed is a stream of malicious open-source packages. SafeDep builds the feed from its malware analysis and serves it over an API. Each report names one malicious package and gives a verdict, its indicators, and the campaign it belongs to.
The Threat Intel Feed is a paid add-on. To enable it, talk to a human.

​
What the feed serves

Package reports

One malicious package each, with verdict, confidence, affected versions, indicators, and campaign links.

Campaigns

Named groups of related reports that share an actor, a technique, or one coordinated intent.

​
How it is delivered

The feed is a ConnectRPC service on the SafeDep Cloud data plane at https://api.safedep.io. You can call it as plain JSON over HTTP, as gRPC, or as gRPC-Web. All three use one URL. Any HTTP client works, and you do not need generated code to start. The feed is built for incremental pulls: the list endpoints re-serve a record whenever it changes (a new verdict, new indicators, or a withdrawal). You fetch changes with a cursor and a timestamp.

​
Where to go next

Quickstart

Set your credentials and run your first query.

Concepts

Reports, verdicts, campaigns, indicators, and how the change feed works.

Pagination & sync

Keep a local mirror current with the incremental cursor.

Schema reference

JSON conventions, and where the message and enum definitions live.