Newest indicator first seen 2026-11-07.
Sources
abuse.ch URLhausCC0-1.0 (public domain)
URLs and domains that serve malware. We match them against what we find inside a scanned artifact.
Freshness: Refreshed daily. A domain or IP stops matching 30 days after URLhaus last listed it, and matches again if URLhaus lists it again.
What it cannot tell you: It covers where malware is served from, and says nothing about what a package holds. It almost never holds an npm package hash, so we answer npm names from OSV. It reports one bad URL on a host, and we match the host. We read only what it added lately. So we cannot see a host being cleaned up, and a host can keep matching until the days above run out.
abuse.ch ThreatFoxCC0-1.0 (public domain)
IPs, domains and file hashes that active malware uses to phone home.
Freshness: Refreshed daily. A domain or IP stops matching 180 days after ThreatFox last listed it, in line with ThreatFox expiring its own indicators after six months. A file hash does not stop matching.
What it cannot tell you: Indicator-based. A brand-new C2 that nobody has reported yet is not in it, and neither are we.
OSV / OpenSSF malicious-packagesCC-BY-4.0 (advisory data)
Published malware lists for packages: MAL records and matching GHSA malware advisories. An npm package can only get a `malicious` verdict through these.
Freshness: We ask live on each request, and keep no stale copy.
What it cannot tell you: A listing comes after someone finds the attack, at times days after. A package published as malware an hour ago is not in it yet. Listings name exact versions, so we may have no answer for an unpinned name.
Lazaretto rule engineProprietary
Fixed rules that read the artifact itself. They look for credential access, data sent out, hidden code, dynamic execution, persistence, install-time droppers and prompt injection.
Freshness: Each change bumps `rules_version` and drops cached verdicts.
What it cannot tell you: Rules alone stop at `flagged` and never give `malicious`. They read source text. We report a minified or packed bundle as partly read, and never skip it without saying so.
Licences behind the indicators that can match
CC0-1.0: 91,698 indicatorsinternal-corpus: 16 indicators
The abuse.ch feeds are public domain, so no licence makes us credit them. We do it because you should know whose data is behind a verdict.
What we do not cover
We state this as plainly as what we do cover. A clear verdict makes no promise about
the code, and you should never read it as one:
- We run nothing. So we cannot see what only happens at run time, on a live network or on one OS.
- We do not use reputation or machine learning to spot new malware. If nothing matches and no rule fires, we say just that. It makes no promise about the code.
- A very large package can go past our size limit. We mark that report as partial, and do not call it a confident `clear`.
- Our rules can only partly read a minified or bundled artifact. The report says so when that happens.
- Malware lists look backward. There is a gap between a bad release and its listing, and nothing here closes it.
- A listing does not last forever. A host that left a list but still serves malware no longer matches when its days run out. The rules still read the file.
How these sources behave in practice
Naming an upstream says where the data came from, not how much of it lands as noise on a package you meant to install. That is measured separately and published with the corpus attached, including the packages we flagged out of a list people install on purpose, and every attack sample of ours that goes undetected: how often we flag a package people install on purpose.
Check us
Live counts and freshness: /v1/health · rule catalog: /v1/rules · our own noise numbers: /benchmark · mistakes we have corrected: /corrections