Open Source Malware
Connect the Open Source Malware threat feed to RAD Security for malicious package intelligence.
This guide walks you through connecting the Open Source Malware threat feed to RAD Security so that newly published malicious packages (npm, PyPI, and other ecosystems) flow into your workspace as threat indicators.
Open Source Malware curates intelligence on packages, domains, and repositories that have been observed delivering malware in open source ecosystems. With this integration RAD Security continuously pulls the latest indicators on a schedule and surfaces matches against the workloads, dependencies, and runtime activity it already sees.
Prerequisites
Before you begin, ensure you have:
- An Open Source Malware account with an API token
- Access to a RAD Security workspace with integration permissions
If you do not yet have an Open Source Malware account, sign up at opensourcemalware.com and request API access.
Step 1: Generate an Open Source Malware API Token
Sign in to Open Source Malware
Sign in to your Open Source Malware account at https://opensourcemalware.com.
Create an API Token
- Navigate to your Account or API settings
- Click Create API token
- Give the token a recognizable name (e.g.
RAD Security) - Copy the token value
The token is typically shown only once. Store it in a password manager or secrets vault before leaving the page.
Step 2: Configure in RAD Security
In your RAD Security workspace, add a new Open Source Malware integration with the following parameter:
| Parameter | Description | Example |
|---|---|---|
| API Token | The API token generated in Step 1 | osm_live_... |
When you save the integration RAD Security verifies the token by calling the Open Source Malware API and immediately schedules the recurring threat feed pull.
Verify Integration
- Navigate to Data Sources → Integrations in RAD Security
- Locate your Open Source Malware integration
- Confirm the connection status shows as Connected
- After the first sync window, open Threat Vectors / Threat Feeds and filter for the Open Source Malware source to see ingested indicators
Your Open Source Malware integration is now active. RAD Security will continue to pull new malicious package indicators on its sync interval.
What Data is Synced
Use Cases
Dependency Risk Detect when your repositories or running containers consume packages that match a known malicious indicator.
Supply Chain Threats Block or alert on workloads that pull a newly disclosed malicious package soon after it is published.
Threat Hunting Pivot on shared indicators (domains, repos, hashes) to discover related activity across your environment.
Incident Triage Enrich incidents with curated open source malware context so responders can quickly judge severity.
Troubleshooting
Security Best Practices
Dedicated Token Use a token created specifically for the RAD Security integration so it can be rotated and audited independently.
Rotate Regularly Rotate the API token on a schedule that matches your security policy (e.g. every 90 days).
Secret Storage Store the API token in a secrets manager. Never commit it to source control or share it in chat.
Monitor Sync Health Watch the integration's Last sync status — a stale sync usually means the token has expired or has been revoked.