Introducing SafeDep Threat Intel

• Sep 8, 2026 • 1 min read

SafeDep Threat Intel is now available as an add-on to any paid plan.

It gives SOC and cyber defense teams the malicious package intelligence behind SafeDep’s platform. They can query it, or push it into the tools they already run to protect against supply chain attacks in their network.

Check out the 📑 Documentation

What’s in it?

Malicious package feed API. A continuous stream of suspicious and confirmed malicious packages, campaigns, and indicators of compromise (IoCs) across npm, PyPI, Go, Maven, and more.

1
export SAFEDEP_API_KEY="<your-api-key>"
2
export SAFEDEP_TENANT_ID="your-company.safedep.io"
3
export TI="https://api.safedep.io/safedep.services.threatintel.v1.ThreatIntelService"
4

5
curl -sS "$TI/ListPackageReports" \
6
  -H "Content-Type: application/json" \
7
  -H "Authorization: $SAFEDEP_API_KEY" \
8
  -H "X-Tenant-ID: $SAFEDEP_TENANT_ID" \
9
  -d '{"pagination":{"pageSize":5,"sortOrder":"SORT_ORDER_DESCENDING"}}'

SafeDep Threat Intel Dashboard. A curated place for all verdicts, reasoning, and campaigns in the SafeDep console.

Package Verdict Feed

Threat Intel dashboard listing malicious package verdicts

Package Verdict Details

Verdict detail panel for a single malicious package

Campaigns

Campaign view grouping related malicious packages

🚀 Quickstart with SafeDep Threat Intel

Support

Contact us via email, Discord and other channels.

threat-intelligence
malware
supply-chain
secops

Author

Kunal Singh

safedep.io

Share

Security

October 2026 Security Incident Review: PHP, Binance, Cursor, LiteLLM and More

October was Cybersecurity Awareness Month. It was also the month PHP, Railway, OpenCode, Binance, Polymarket, Cursor, LiteLLM and eight more made the news for a security incident. A short recap of...

Malware

testmetest npm Packages Carry a Miasma-Family Worm

19 npm packages carry a Miasma-family worm that steals credentials, spreads to other packages and installs a wiper. The newest builds start the worm when an application loads the package.

Security

eMudhra CA Key Compromise: Response Guide for Developers

Anyone can compute eight eMudhra intermediate CA private keys from public certificates. Browsers block the compromised intermediates, but CI runners, containers, JVMs and Go binaries can still trust...

Security

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Every wheel of LiteLLM 1.107.0 on PyPI installs a credential stealer and a remote code execution backdoor. Both run each time Python starts. The code is not in the upstream GitHub source.