Skip to main content

Access the Software Supply Chain Intelligence (SSCI) threat feed API

note

We are transitioning our infrastructure from Phylum to the Veracode Platform. We will provide an update after we complete the transition.

Software Supply Chain Intelligence (SSCI) provides a curated view of malware released across the open-source ecosystems that we monitor. Our automated risk analysis platform identifies packages in SSCI. A team of security researchers then triages and reviews these packages.

SSCI provides two feeds:

  • Threat feed: contains information about malicious packages only.
  • Reputation feed: contains information about malicious packages, vulnerabilities, and license data.

Get started​

To get started, obtain an API access token and use the following command to set it:

PHYLUM_API=<PHYLUM API ACCESS TOKEN>

Use your Phylum API access token to retrieve the latest packages in SSCI:

curl https://threats.phylum.io -H "Authorization: Bearer $PHYLUM_API"

SSCI also supports cursor-based pagination.

Understand API responses​

has_next - true if another page is available in the feed has_previous - true if a previous page exists in the feed packages - a list containing threat information

For example:

{
  "has_next": {true|false},
  "has_previous": {true|false},
  "packages": [threat information list]
}

Packages contain the following top-level keys:

created: the date the package was published ecosystem: the ecosystem the package was published to hashes: the hashes for published package archives indicators: the indicators that identified this package as a threat name: the name of the package version: the version of the package

The following example shows an API response from SSCI with the top-level keys:

{
  "has_next": true,
  "has_previous": false,
  "packages": [
    {
      "created": "Mon, 31 Jul 2023 00:52:09 GMT",
      "ecosystem": "npm",
      "hashes": [
        {
          "archive": "cz-react-ui-library-8.0.0.tgz",
          "hash": "1f9e0dd70cbd5928d41be7a1fb110e679b10ac41edafdaace8084e5d1031ca2a",
          "type": "SHA256"
        }
      ],
      "indicators": {
        "npm_hooks_rule": [
          "node index.js"
        ],
        "suspicious_url_references_rule": [
          {
            "file": "package/index.js",
            "urls": [
              "an OAST server"
            ]
          }
        ],
        "trivial_package_rule": true
      },
      "name": "cz-react-ui-library",
      "version": "8.0.0"
    },
  ...
  ]
}

Use query parameters​

The SSCI API provides several parameters to interact with the feed:

ParameterDescription
pagethe page of the feed to retrieve
per_pagethe number of items per page; default is 25, maximum is 50
sinceitems added to the feed since the given date in YYYY-MM-DD format (for example, 2023-06-18)

To limit items per page to 3 since July 19, 2023, send a GET request to the following URL:

https://threats.phylum.io/?per_page=3&since=2023-07-19

Use cursor-based pagination​

SSCI supports cursor-based pagination. Provide the cursor parameter to iterate through the data in a guaranteed order. For example:

curl "https://threats.phylum.io/?cursor=84" -H "Authorization: Bearer $PHYLUM_API"

If additional rows exist, the response includes the next cursor in the cursor key. The cursor value is null when all rows have been retrieved.

{
  "cursor": 2722653,
  "packages": [
    {
      "created": "Wed, 28 Aug 2024 22:24:28 GMT",
      "ecosystem": "npm",
      "hashes": null,
      "indicators": {
        "npm_security_holding_rule": true,
        "triaged_malware_rule": true
      },
      "name": "@hishprorg/sequi-perspiciatis",
      "version": "0.0.1-security"
    },
    {
      "created": "Wed, 28 Aug 2024 23:29:13 GMT",
      "ecosystem": "npm",
      "hashes": null,
      "indicators": {
        "npm_security_holding_rule": true,
        "triaged_malware_rule": true
      },
      "name": "@hishprorg/necessitatibus-minus-quos",
      "version": "0.0.1-security"
    }
  ]
}

For cursor-based data retrieval, provide the per_page query parameter to specify how many rows to return. The default value is 25, and the maximum is 50.

curl "https://threats.phylum.io/?cursor=84&per_page=10" -H "Authorization: Bearer $PHYLUM_API"

Generate an API access token​

You can use API tokens in CI/CD environments to avoid sharing account credentials.

Before you begin:

To complete this task:

  1. Sign in to Phylum.
  2. In the upper-right corner, select your account, then select API Token Generator.
  3. Provide a name for the new API access token.
  4. Select GENERATE TOKEN, then select the validity period of the access token. Copy the displayed access token.
Last updated on