Free loss-leader: exact known-bad hash lookup.

get/v1/known-bad/{sha256}

Request

  • Base URL: https://lazaretto.dev
  • URL: https://lazaretto.dev/v1/known-bad/{sha256}
  • Auth: none declared

Path parameters

sha256string required

Response

Whether the hash matches a known-bad indicator.

matchedboolean nullable

true=known-bad; false=checked clean; null=could not check (fail-closed).

match_type'exact_hash' | 'fuzzy_hash' | 'embedded_ioc' | 'known_publisher' | 'malicious_package'

How the known-bad match was made. malicious_package means the package identity (name + version) is listed as malware in the OSV/OpenSSF corpus, which is scoped to the affected versions: a project compromised in one release is not condemned in its later clean ones.

sourcesstring[]

Changes

No recorded changes to this operation across all 1 revision of this API.