# Supply Chain Security Feed (TCF-0701) — Spectra Intelligence

> Consume TCF-0701 for malicious Open Source Software packages and reclassification events from Spectra Intelligence, with full historical data and approximately 1-hour delay.

ReversingLabs Supply Chain Indicators of Compromise (IoC) Feed service delivers access to large volumes of structured threat intelligence data for malicious Open Source Software (OSS) packages and subsequent reclassifications. It delivers all historical data and maintains a continuous stream.

The service includes the following primary event types:

- **New Malicious Samples** (`NEW_MALICIOUS`): represents confirmed malicious OSS packages or files.
- **False Positives** (`FP`): marks previously flagged samples that have been reclassified as non-malicious.
- **New Threats** (`NEW_THREAT_NAME`): represents malware packages reclassified with a new threat name after additional analysis.

The service supports time-based querying (e.g., retrieving data after a specified timestamp) and maintains user-specific cursors for reliable incremental consumption.

The feed stores events since 2011-03-29.

## General Info about Requests/Responses

- Default response format is XML. Supported formats are JSON and XML.

## Supply Chain Indicators of Compromise Pull

The Supply Chain Indicators of Compromise (IoC) service delivers access to large volumes of structured threat intelligence data for malicious Open Source Software (OSS) packages and subsequent reclassifications.

<Button title="View OpenAPI Specification" href="" />

### Request

```
GET /api/feed/supply_chain/ioc/v1/query/pull
```

#### Query parameters

- `format`
  - The format of the response. Supported values: `json`, `xml` (default).
  - Optional
- `limit`
  - Number of records to return in the response. The maximum and default value is `1000`. The response may include a little more than the requested number of records to ensure that all the records with the same timestamp are returned.
  - Optional

### Response

The response is a JSON object containing the query parameters and the entries that match the requested query.

- `last_timestamp`: Timestamp of the last entry in the feed
  - Type: string
- `time_range.to`: End time of the query range
  - Type: string
- `time_range.from`: Start time of the query range
  - Type: string
- `entries[]`: Array of supply chain IoC entries
  - Type: array
- `event_type`: Type of event. Supported values: `NEW_MALICIOUS`, `FP`, `NEW_THREAT_NAME`
  - Type: string
- `md5`: MD5 hash of the package
  - Type: string
- `sha1`: SHA1 hash of the package
  - Type: string
- `sha256`: SHA256 hash of the package
  - Type: string
- `sha512`: SHA512 hash of the package
  - Type: string
- `filename`: Name of the package file
  - Type: string
- `sample_size`: Size of the package in bytes
  - Type: string
- `source_url`: URL where the package was downloaded from
  - Type: string
- `identity.purl`: Package URL identifier
  - Type: string
- `identity.community`: Package community (e.g., npm, pypi)
  - Type: string
- `identity.namespace`: Package namespace
  - Type: string
- `identity.package`: Package name
  - Type: string
- `identity.product`: Product name
  - Type: string
- `identity.version`: Package version
  - Type: string
- `identity.artifact`: Artifact identifier
  - Type: string
- `identity.homepage`: Package homepage URL
  - Type: string
- `identity.repository`: Package repository URL
  - Type: string
- `identity.published`: Package publication timestamp
  - Type: string
- `sample_list[]`: List of malicious samples found in the package
  - Type: array
- `sample_list[].status`: Sample status. Supported values: `MALICIOUS`, `KNOWN`, `SUSPICIOUS`, `UNKNOWN`
  - Type: string
- `sample_list[].threat_name`: Name of the detected threat
  - Type: string
- `sample_list[].threat_level`: Threat level (1-5)
  - Type: string
- `sample_list[].md5`: MD5 hash of the sample
  - Type: string
- `sample_list[].sha1`: SHA1 hash of the sample
  - Type: string
- `sample_list[].sha256`: SHA256 hash of the sample
  - Type: string

<details>
<summary>Response example</summary>

``` json
{
  "rl": {
    "supply_chain_ioc_feed": {
      "last_timestamp": "string",
      "time_range": {
        "to": "string",
        "from": "string"
      },
      "entries": [
        {
          "event_type": "NEW_MALICIOUS",
          "md5": "99d1bdaaa2e4a198521bc12df599ead0",
          "sha1": "aad8d679f15a721ed79454d553e3473f9f0536f1",
          "sha256": "e37d30c42c9739dfe153a324885937cbb98ed31760d1ba34d5542b309b2a67b0",
          "sha512": "11d11650fdc393da32c9c4733016d51d85b718b6eae4a3d61cb2a95d23700f917abb4b35c75da698fe0a233a924b3a6782ff3ff291377f8f7fa86046f1582a0a",
          "filename": "ua-parser-js-0.7.29.tgz",
          "sample_size": "57690",
          "source_url": "https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.29.tgz",
          "identity": {
            "purl": "pkg:npm/ua-parser-js@0.7.29",
            "community": "npm",
            "package": "ua-parser-js",
            "version": "0.7.29",
            "homepage": "https://uaparser.dev",
            "repository": "https://github.com/faisalman/ua-parser-js",
            "published": "2025-10-10T03:51:52+0000"
          },
          "sample_list": [
            {
              "status": "MALICIOUS",
              "threat_name": "Archive-GZIP.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "99d1bdaaa2e4a198521bc12df599ead0",
              "sha1": "aad8d679f15a721ed79454d553e3473f9f0536f1",
              "sha256": "e37d30c42c9739dfe153a324885937cbb98ed31760d1ba34d5542b309b2a67b0"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Script-BAT.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "d98a3013336b755b739d285a58528cbe",
              "sha1": "01a2c9815acd76dc827b0325b97b793af3632c18",
              "sha256": "f4c800066e56dd32d20299c451fe6a2b60a3563f7f1915f8ca8db9916d810b5c"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Text.Downloader.SupplyChain",
              "threat_level": "3",
              "sha1": "8b242cf78d082e81b5432c19477ebb80e5cf291a",
              "sha256": "82bd9d21a895327a17a7fd55d8c1270402bd0e5cf0443936be90d3738ce24560"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Script-Shell.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "13f840772c7c04c7d2f4c202ff957b0c",
              "sha1": "69834f154ea070abccb8b08a10fd2da0bcc83543",
              "sha256": "21e68b048024ba0cc5a2a94ecbc3a78c626ec7d5d705829a82ea4715131d0509"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Archive-TAR.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "9f5e525644662588972117c108b7ac03",
              "sha1": "45888251d905bf928db70350717d9451daa60b8c",
              "sha256": "44b01b5c634f93f2433e1796e8804c6ae4da966999d7539d5b8d62fe8c33d414"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Script-JS.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "a4668a1b3f23b79ef07d1afe0152999e",
              "sha1": "1b76d2622ee8729704c56f5f8942a75ab729047b",
              "sha256": "e6cba23d350cb1f049266ddf10f872216f193c5279017408b869539df2e73c83"
            }
          ]
        },
        {
          "event_type": "FP",
          "md5": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
          "sha1": "1234567890abcdef1234567890abcdef12345678",
          "sha256": "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
          "sha512": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
          "filename": "example-package-1.0.0.tgz",
          "sample_size": "12345",
          "source_url": "https://registry.npmjs.org/example-package/-/example-package-1.0.0.tgz",
          "identity": {
            "purl": "pkg:npm/example-package@1.0.0",
            "community": "npm",
            "package": "example-package",
            "version": "1.0.0",
            "homepage": "https://example.com",
            "repository": "https://github.com/example/example-package",
            "published": "2025-06-15T10:30:00+0000"
          },
          "sample_list": [
            {
              "status": "KNOWN",
              "threat_name": "",
              "threat_level": "0",
              "md5": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
              "sha1": "1234567890abcdef1234567890abcdef12345678",
              "sha256": "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890"
            }
          ]
        },
        {
          "event_type": "NEW_THREAT_NAME",
          "md5": "b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5",
          "sha1": "234567890abcdef1234567890abcdef123456789",
          "sha256": "bcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab",
          "sha512": "234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12",
          "filename": "threat-package-2.0.0.tgz",
          "sample_size": "23456",
          "source_url": "https://registry.npmjs.org/threat-package/-/threat-package-2.0.0.tgz",
          "identity": {
            "purl": "pkg:npm/threat-package@2.0.0",
            "community": "npm",
            "package": "threat-package",
            "version": "2.0.0",
            "homepage": "https://threat-example.com",
            "repository": "https://github.com/example/threat-package",
            "published": "2025-07-20T14:45:00+0000"
          },
          "sample_list": [
            {
              "status": "MALICIOUS",
              "threat_name": "Script-JS.Trojan.SupplyChain",
              "threat_level": "4",
              "md5": "b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5",
              "sha1": "234567890abcdef1234567890abcdef123456789",
              "sha256": "bcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab"
            }
          ]
        }
      ]
    }
  }
}
```

</details>

## Supply Chain Indicators of Compromise Start

Starts the Supply Chain Indicators of Compromise (IoC) feed session and initializes access to structured threat intelligence data for malicious Open Source Software (OSS) packages.

<Button title="View OpenAPI Specification" href="" />

### Request

```
PUT /api/feed/supply_chain/ioc/v1/query/start
```

### Response

| Code     | Message              |
|----------|----------------------|
| `200`    | Successfully started |

## Supply Chain Indicators of Compromise Time Range

Retrieve feed data starting from a specific time. The Supply Chain Indicators of Compromise (IoC) service delivers access to large volumes of structured threat intelligence data for malicious Open Source Software (OSS) packages and subsequent reclassifications.

<Button title="View OpenAPI Specification" href="" />

### Request

```
GET /api/feed/supply_chain/ioc/v1/query/{time_format}/{time}
```

#### Path parameters

- `time_format`
  - The format of the time value. Supported values: `utc` or `timestamp`.
  - Required
- `time`
  - The time value corresponding to the given format.
  - Required

#### Query parameters

- `format`
  - The format of the response. Supported values: `json`, `xml` (default).
  - Optional
- `limit`
  - The maximum number of results to be retrieved. Supported values: 1 - 1000. Default is 1000.
  - Optional

### Response

The response is a JSON object containing the query parameters and the entries that match the requested query.

- `last_timestamp`: Timestamp of the last entry in the feed
  - Type: string
- `time_range.to`: End time of the query range
  - Type: string
- `time_range.from`: Start time of the query range
  - Type: string
- `entries[]`: Array of supply chain IoC entries
  - Type: array
- `event_type`: Type of event. Supported values: `NEW_MALICIOUS`, `FP`, `NEW_THREAT_NAME`
  - Type: string
- `md5`: MD5 hash of the package
  - Type: string
- `sha1`: SHA1 hash of the package
  - Type: string
- `sha256`: SHA256 hash of the package
  - Type: string
- `sha512`: SHA512 hash of the package
  - Type: string
- `filename`: Name of the package file
  - Type: string
- `sample_size`: Size of the package in bytes
  - Type: string
- `source_url`: URL where the package was downloaded from
  - Type: string
- `identity.purl`: Package URL identifier
  - Type: string
- `identity.community`: Package community (e.g., npm, pypi)
  - Type: string
- `identity.namespace`: Package namespace
  - Type: string
- `identity.package`: Package name
  - Type: string
- `identity.product`: Product name
  - Type: string
- `identity.version`: Package version
  - Type: string
- `identity.artifact`: Artifact identifier
  - Type: string
- `identity.homepage`: Package homepage URL
  - Type: string
- `identity.repository`: Package repository URL
  - Type: string
- `identity.published`: Package publication timestamp
  - Type: string
- `sample_list[]`: List of malicious samples found in the package
  - Type: array
- `sample_list[].status`: Sample status. Supported values: `MALICIOUS`, `KNOWN`, `SUSPICIOUS`, `UNKNOWN`
  - Type: string
- `sample_list[].threat_name`: Name of the detected threat
  - Type: string
- `sample_list[].threat_level`: Threat level (1-5)
  - Type: string
- `sample_list[].md5`: MD5 hash of the sample
  - Type: string
- `sample_list[].sha1`: SHA1 hash of the sample
  - Type: string
- `sample_list[].sha256`: SHA256 hash of the sample
  - Type: string

<details>
<summary>Response example</summary>

``` json
{
  "rl": {
    "supply_chain_ioc_feed": {
      "last_timestamp": "string",
      "time_range": {
        "to": "string",
        "from": "string"
      },
      "entries": [
        {
          "event_type": "NEW_MALICIOUS",
          "md5": "99d1bdaaa2e4a198521bc12df599ead0",
          "sha1": "aad8d679f15a721ed79454d553e3473f9f0536f1",
          "sha256": "e37d30c42c9739dfe153a324885937cbb98ed31760d1ba34d5542b309b2a67b0",
          "sha512": "11d11650fdc393da32c9c4733016d51d85b718b6eae4a3d61cb2a95d23700f917abb4b35c75da698fe0a233a924b3a6782ff3ff291377f8f7fa86046f1582a0a",
          "filename": "ua-parser-js-0.7.29.tgz",
          "sample_size": "57690",
          "source_url": "https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.29.tgz",
          "identity": {
            "purl": "pkg:npm/ua-parser-js@0.7.29",
            "community": "npm",
            "package": "ua-parser-js",
            "version": "0.7.29",
            "homepage": "https://uaparser.dev",
            "repository": "https://github.com/faisalman/ua-parser-js",
            "published": "2025-10-10T03:51:52+0000"
          },
          "sample_list": [
            {
              "status": "MALICIOUS",
              "threat_name": "Archive-GZIP.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "99d1bdaaa2e4a198521bc12df599ead0",
              "sha1": "aad8d679f15a721ed79454d553e3473f9f0536f1",
              "sha256": "e37d30c42c9739dfe153a324885937cbb98ed31760d1ba34d5542b309b2a67b0"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Script-BAT.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "d98a3013336b755b739d285a58528cbe",
              "sha1": "01a2c9815acd76dc827b0325b97b793af3632c18",
              "sha256": "f4c800066e56dd32d20299c451fe6a2b60a3563f7f1915f8ca8db9916d810b5c"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Text.Downloader.SupplyChain",
              "threat_level": "3",
              "sha1": "8b242cf78d082e81b5432c19477ebb80e5cf291a",
              "sha256": "82bd9d21a895327a17a7fd55d8c1270402bd0e5cf0443936be90d3738ce24560"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Script-Shell.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "13f840772c7c04c7d2f4c202ff957b0c",
              "sha1": "69834f154ea070abccb8b08a10fd2da0bcc83543",
              "sha256": "21e68b048024ba0cc5a2a94ecbc3a78c626ec7d5d705829a82ea4715131d0509"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Archive-TAR.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "9f5e525644662588972117c108b7ac03",
              "sha1": "45888251d905bf928db70350717d9451daa60b8c",
              "sha256": "44b01b5c634f93f2433e1796e8804c6ae4da966999d7539d5b8d62fe8c33d414"
            },
            {
              "status": "MALICIOUS",
              "threat_name": "Script-JS.Downloader.SupplyChain",
              "threat_level": "3",
              "md5": "a4668a1b3f23b79ef07d1afe0152999e",
              "sha1": "1b76d2622ee8729704c56f5f8942a75ab729047b",
              "sha256": "e6cba23d350cb1f049266ddf10f872216f193c5279017408b869539df2e73c83"
            }
          ]
        },
        {
          "event_type": "FP",
          "md5": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
          "sha1": "1234567890abcdef1234567890abcdef12345678",
          "sha256": "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890",
          "sha512": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
          "filename": "example-package-1.0.0.tgz",
          "sample_size": "12345",
          "source_url": "https://registry.npmjs.org/example-package/-/example-package-1.0.0.tgz",
          "identity": {
            "purl": "pkg:npm/example-package@1.0.0",
            "community": "npm",
            "package": "example-package",
            "version": "1.0.0",
            "homepage": "https://example.com",
            "repository": "https://github.com/example/example-package",
            "published": "2025-06-15T10:30:00+0000"
          },
          "sample_list": [
            {
              "status": "KNOWN",
              "threat_name": "",
              "threat_level": "0",
              "md5": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
              "sha1": "1234567890abcdef1234567890abcdef12345678",
              "sha256": "abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890"
            }
          ]
        },
        {
          "event_type": "NEW_THREAT_NAME",
          "md5": "b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5",
          "sha1": "234567890abcdef1234567890abcdef123456789",
          "sha256": "bcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab",
          "sha512": "234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12",
          "filename": "threat-package-2.0.0.tgz",
          "sample_size": "23456",
          "source_url": "https://registry.npmjs.org/threat-package/-/threat-package-2.0.0.tgz",
          "identity": {
            "purl": "pkg:npm/threat-package@2.0.0",
            "community": "npm",
            "package": "threat-package",
            "version": "2.0.0",
            "homepage": "https://threat-example.com",
            "repository": "https://github.com/example/threat-package",
            "published": "2025-07-20T14:45:00+0000"
          },
          "sample_list": [
            {
              "status": "MALICIOUS",
              "threat_name": "Script-JS.Trojan.SupplyChain",
              "threat_level": "4",
              "md5": "b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5",
              "sha1": "234567890abcdef1234567890abcdef123456789",
              "sha256": "bcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890ab"
            }
          ]
        }
      ]
    }
  }
}
```

</details>
