Skip to main content

Supply Chain Security Feed (TCF-0701) — Spectra Intelligence

The ReversingLabs Supply Chain Indicators of Compromise (IoC) Feed delivers structured threat intelligence data for malicious Open Source Software (OSS) packages and subsequent reclassifications. It combines manual overrides from ReversingLabs threat analysts with automated detections from ReversingLabs scanner policies, giving you broader, more comprehensive coverage of supply chain threats. The feed provides all historical data (since 2011-03-29) and maintains a continuous stream.

The service includes the following primary event types:

  • New Malicious Samples (NEW_MALICIOUS): represents confirmed malicious OSS packages or files, detected either by an RL analyst override or by an RL scanner policy (or both). See Detection sources for the full policy mapping.
  • False Positives (FP): marks previously flagged samples that have been reclassified as non-malicious.
  • New Threats (NEW_THREAT_NAME): represents malware packages reclassified with a new threat name after additional analysis.

The service supports time-based querying (for example, retrieving data after a specified timestamp) and maintains user-specific cursors for reliable incremental consumption.

The default response format is XML. Supported formats are JSON and XML.

For complete request and response specifications, including parameters, schemas, status codes, and code samples, see the OpenAPI reference for each endpoint linked below.

Detection sources​

NEW_MALICIOUS events are generated from two detection sources:

  • RL Analyst: manual overrides applied by ReversingLabs threat analysts. Tracked under policies SQ30105 and SQ30109.
  • RL Scanner: automated detections from ReversingLabs scanner policies. Tracked under policies SQ30103, SQ30104, SQ30106, SQ30107, SQ30108, SQ30110, SQ30120, SQ30121, and SQ30122.

Suspicious detections and policies in the SQ302** range are excluded from this feed to keep reporting limited to high-confidence malicious verdicts.

Each NEW_MALICIOUS entry includes a reasons array that identifies which detection source (or sources) triggered it:

  • rl-analyst: the package was flagged by a manual RL analyst override.
  • rl-scanner: the package was flagged by an automated RL scanner policy.

The array can include both values if the package was flagged independently by an analyst and by the scanner. The field applies to the whole entry — individual samples in sample_list don't carry their own reasons. For example:

{
    "event_type": "NEW_MALICIOUS",
    "filename": "ua-parser-js-0.7.29.tgz",
    "sample_size": "57690",
    "source_url": "https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.29.tgz",
    "reasons": [
        "rl-analyst",
        "rl-scanner"
    ]
}

Endpoints​

Start​

Starts the Supply Chain Indicators of Compromise (IoC) feed session and initializes access to the data stream.

PUT /api/feed/supply_chain/ioc/v1/query/start
View OpenAPI Specification

Pull​

Retrieves the next set of feed entries from the user-specific cursor position.

GET /api/feed/supply_chain/ioc/v1/query/pull
View OpenAPI Specification

Time range​

Retrieves feed entries starting from a specific time, identified either as a UTC date or as a Unix timestamp.

GET /api/feed/supply_chain/ioc/v1/query/{time_format}/{time_value}
View OpenAPI Specification