Introducing SafeDep Threat Intel

SafeDep has launched SafeDep Threat Intel, an add-on to any paid plan that provides SOC and cyber defense teams with a malicious package feed API and a Threat Intel Dashboard, covering npm, PyPI, Go, Maven, and more. The service offers continuous streams of suspicious and confirmed malicious packages, campaigns, and indicators of compromise, aiming to protect against supply chain attacks.

Introducing SafeDep Threat Intel SafeDep Threat Intel is now available as an add-on to any paid plan https://safedep.io/pricing threat-intel . It gives SOC and cyber defense teams the malicious package intelligence behind SafeDep’s platform. They can query it, or push it into the tools they already run to protect against supply chain attacks in their network. Check out the 📑 Documentation https://docs.safedep.io/threat-intel/overview What’s in it? Malicious package feed API. A continuous stream of suspicious and confirmed malicious packages, campaigns, and indicators of compromise IoCs across npm, PyPI, Go, Maven, and more. SafeDep Threat Intel Dashboard. A curated place for all verdicts, reasoning, and campaigns in the SafeDep console https://app.safedep.io . Package Verdict Feed Package Verdict Details Campaigns 🚀 Quickstart https://docs.safedep.io/threat-intel/overview with SafeDep Threat Intel Support Contact us https://safedep.io/contact/ via email, Discord and other channels https://docs.safedep.io/community . - threat-intelligence - malware - supply-chain - secops Author Kunal Singh https://www.linkedin.com/in/kunalsin9h/ safedep.io Share The Latest from SafeDep blogs Follow for the latest updates and insights on open source security & engineering A malicious npm package hidden three dependencies deep: the ulid-xyz delivery chain /ulid-xyz-transitive-dependency-delivery-chain ulid-xyz is a remote access trojan we reported to OSV as MAL-2026-6672. It reached developers as a third-level transitive dependency of ioredis-xyz, a copy of the real Redis client planted in 28... From YouTube Ad to Root: How a Fake TradingView Installer Delivers a macOS Stealer /youtube-ad-fake-tradingview-macos-stealer A YouTube video ad impersonating TradingView delivered a fake .pkg installer. Inside: a self-healing LaunchAgent, an AES-encrypted V8 bytecode payload, and a Node.js MITM proxy trusted by a rogue... Mini Shai-Hulud Strikes Again: openapi-react-query-codegen /mini-shai-hulud-openapi-react-query-codegen-compromised An attacker exploited a flawed GitHub Actions workflow to publish 10 malicious versions of @7nohe/openapi-react-query-codegen 671K downloads/month via npm OIDC trusted publishing. The payload uses... Malicious Rust Crate arrayref Runs a Build-Time Payload /arrayref-proc-macro1-rust-build-time-malware A compromised release of the popular Rust crate arrayref pulled in a typosquatted proc-macro1 whose build script downloads and runs a remote binary at compile time. The malicious versions are now... Ship Code. Not Malware. Start free with open source tools on your machine. Scale to a unified platform for your organization.