--- title: "Where our data comes from. Lazaretto" description: "Every indicator source behind a Lazaretto verdict, with licence, refresh cadence, and an explicit statement of what each source cannot tell you." url: "https://lazaretto.dev/sources" --- [Home](https://lazaretto.dev/) / [Trust](https://lazaretto.dev/trust) / Sources Provenance # Where our data comes from A verdict is only as good as its data. Here are our sources, their licences, how fresh they are and what each one cannot tell you. **91,714** indicators that can match **78** rules in 8 categories **2026.11.04b** rules version Newest indicator first seen **2026-11-07**. ## Sources ### abuse.ch URLhausCC0-1.0 (public domain) URLs and domains that serve malware. We match them against what we find inside a scanned artifact. **Freshness:** Refreshed daily. A domain or IP stops matching 30 days after URLhaus last listed it, and matches again if URLhaus lists it again. **What it cannot tell you:** It covers where malware is served from, and says nothing about what a package holds. It almost never holds an npm package hash, so we answer npm names from OSV. It reports one bad URL on a host, and we match the host. We read only what it added lately. So we cannot see a host being cleaned up, and a host can keep matching until the days above run out. [https://urlhaus.abuse.ch/](https://urlhaus.abuse.ch/) ### abuse.ch ThreatFoxCC0-1.0 (public domain) IPs, domains and file hashes that active malware uses to phone home. **Freshness:** Refreshed daily. A domain or IP stops matching 180 days after ThreatFox last listed it, in line with ThreatFox expiring its own indicators after six months. A file hash does not stop matching. **What it cannot tell you:** Indicator-based. A brand-new C2 that nobody has reported yet is not in it, and neither are we. [https://threatfox.abuse.ch/](https://threatfox.abuse.ch/) ### OSV / OpenSSF malicious-packagesCC-BY-4.0 (advisory data) Published malware lists for packages: MAL records and matching GHSA malware advisories. An npm package can only get a `malicious` verdict through these. **Freshness:** We ask live on each request, and keep no stale copy. **What it cannot tell you:** A listing comes after someone finds the attack, at times days after. A package published as malware an hour ago is not in it yet. Listings name exact versions, so we may have no answer for an unpinned name. [https://osv.dev/](https://osv.dev/) ### Lazaretto rule engineProprietary Fixed rules that read the artifact itself. They look for credential access, data sent out, hidden code, dynamic execution, persistence, install-time droppers and prompt injection. **Freshness:** Each change bumps `rules_version` and drops cached verdicts. **What it cannot tell you:** Rules alone stop at `flagged` and never give `malicious`. They read source text. We report a minified or packed bundle as partly read, and never skip it without saying so. [/v1/rules](https://lazaretto.dev/v1/rules) ## Licences behind the indicators that can match - `CC0-1.0`: 91,698 indicators - `internal-corpus`: 16 indicators The abuse.ch feeds are public domain, so no licence makes us credit them. We do it because you should know whose data is behind a verdict. ## What we do not cover We state this as plainly as what we do cover. A `clear` verdict makes no promise about the code, and you should never read it as one: - We run nothing. So we cannot see what only happens at run time, on a live network or on one OS. - We do not use reputation or machine learning to spot new malware. If nothing matches and no rule fires, we say just that. It makes no promise about the code. - A very large package can go past our size limit. We mark that report as partial, and do not call it a confident `clear`. - Our rules can only partly read a minified or bundled artifact. The report says so when that happens. - Malware lists look backward. There is a gap between a bad release and its listing, and nothing here closes it. - A listing does not last forever. A host that left a list but still serves malware no longer matches when its days run out. The rules still read the file. ## How these sources behave in practice Naming an upstream says where the data came from, not how much of it lands as noise on a package you meant to install. That is measured separately and published with the corpus attached, including the packages we flagged out of a list people install on purpose, and every attack sample of ours that goes undetected: [how often we flag a package people install on purpose](https://lazaretto.dev/benchmark). ## Check us Live counts and freshness: [/v1/health](https://lazaretto.dev/v1/health) · rule catalog: [/v1/rules](https://lazaretto.dev/v1/rules) · our own noise numbers: [/benchmark](https://lazaretto.dev/benchmark) · mistakes we have corrected: [/corrections](https://lazaretto.dev/corrections) --- Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.