SafeDep launches Threat Intel add-on with malicious package feed API for npm, PyPI, Go and Maven

Linha do tempo

1. safedep.io ↗ · pub. 08/09/2026 05:00 · coletado 19/10 18:03 primeiro registro

   SafeDep launches Threat Intel add-on with malicious package feed API for npm, PyPI, Go and Maven

   ler a análise desta fonte ocultar

   SafeDep announced SafeDep Threat Intel, an add-on to any paid plan that gives SOC and cyber defense teams the malicious package intelligence behind its platform. It is a product announcement, not a security incident. Customers can query the data directly or push it into existing tooling to defend against software supply chain attacks. It offers a continuous feed of suspicious and confirmed malicious packages, campaigns and indicators of compromise (IoCs) across npm, PyPI, Go, Maven and other ecosystems, plus a console dashboard with verdicts, reasoning and campaigns. The page also links to recent SafeDep research posts on supply chain threats.

   Technical Details

   • The feed is exposed through a ThreatIntelService API (ListPackageReports) authenticated with an API key and tenant ID header, supporting pagination and sort order.
   • Teaser items on the page reference: the MALFEX package imgdecode, which contains a native Windows loader that tries to download, decrypt and inject shellcode into dllhost.exe; an npm package that ran a Mini Shai-Hulud worm at install after a maintainer account committed the payload via the GitHub web interface and the official release workflow published it; an extortion note pushed to ASOS customers' phones via compromised messaging platforms; and one RubyGems account publishing 42 gems that run code at install, opening a reverse shell or fetching a second stage on developer workstations but not on CI runners.
   • The article gives no further technical detail on these items.