Introducing SafeDep Threat Intel

• Sep 8, 2026 • 1 min read

SafeDep Threat Intel is now available as an add-on to any paid plan.

It gives SOC and cyber defense teams the malicious package intelligence behind SafeDep’s platform. They can query it, or push it into the tools they already run to protect against supply chain attacks in their network.

Check out the 📑 Documentation

What’s in it?

Malicious package feed API. A continuous stream of suspicious and confirmed malicious packages, campaigns, and indicators of compromise (IoCs) across npm, PyPI, Go, Maven, and more.

1
export SAFEDEP_API_KEY="<your-api-key>"
2
export SAFEDEP_TENANT_ID="your-company.safedep.io"
3
export TI="https://api.safedep.io/safedep.services.threatintel.v1.ThreatIntelService"
4

5
curl -sS "$TI/ListPackageReports" \
6
  -H "Content-Type: application/json" \
7
  -H "Authorization: $SAFEDEP_API_KEY" \
8
  -H "X-Tenant-ID: $SAFEDEP_TENANT_ID" \
9
  -d '{"pagination":{"pageSize":5,"sortOrder":"SORT_ORDER_DESCENDING"}}'

SafeDep Threat Intel Dashboard. A curated place for all verdicts, reasoning, and campaigns in the SafeDep console.

Package Verdict Feed

Threat Intel dashboard listing malicious package verdicts

Package Verdict Details

Verdict detail panel for a single malicious package

Campaigns

Campaign view grouping related malicious packages

🚀 Quickstart with SafeDep Threat Intel

Support

Contact us via email, Discord and other channels.

threat-intelligence
malware
supply-chain
secops

Author

Kunal Singh

safedep.io

Share

Security

DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm

Nine fake Express and React packages on npm run a Linux worm at install time. It installs a Tor backdoor and spreads through SSH, AUR packages, and npm tokens.

Malware

Mini Shai-Hulud Is Still Infecting GitHub Repositories

The May 2026 Mini Shai-Hulud worm is still infecting new GitHub repositories. Hijacked actions-cool/issues-helper tags planted Claude Code and VS Code hooks in six popular repositories between 20 and...

Detecting Compromised AI Coding Agents with Jev and Gryph

I checked every action of my own Claude Code agent against a profile of how I work and a set of org policies, using Jev. It caught 14 of 14 attacks for $0.15 per 1,000 events.

Security

MemTensor npm and PyPI Packages Hit by a Go Worm

An attacker used a Go worm to steal CI publish tokens from MemTensor and ship malicious MemOS packages to npm and PyPI. See how it works, with code and indicators of compromise.