---
title: "Check public npm packages for known malware"
method: POST
path: "/v1/packages/malware/checks"
tags: ["packages"]
---

# Check public npm packages for known malware

`POST /v1/packages/malware/checks`

## Request

- The document declares no server URL.
- Auth: none required

Returns bounded public malware observations for exact npm releases. Results are for this request only and are not cached.

## Request body

- object
  - `packages` object[], required
    - `purl` string, required
  - `candidateRevision` string

## Response `200`

Default Response

- object
  - `context` object, required
    - `mode` 'public-malware', required
    - `evaluatorVersion` 'public-malware-v1', required
    - `consistency` 'request-observation', required
    - `intelligenceRevision` unknown, required
    - `observedAt` string, date-time, required
    - `reuse` 'none', required
    - `expiresAt` unknown, required
    - `sourceAsOf` unknown, required
  - `results` union[], required
    - union
      - object
        - `index` integer, required
        - `inputPurl` string, required
        - `canonicalPurl` string, nullable, required
        - `status` 'confirmed_malware', required
        - `reasonCodes` unknown[], required
          - unknown
        - `findings` object[], required
          - `scope` 'version' | 'package' | 'author', required
          - `code` 'reviewed_malware' | 'package_bad_intent' | 'author_bad_intent', required
          - `url` string, uri, required
        - `findingsTruncated` boolean, required
        - `coverage` object, required
          - `registry` 'https://registry.npmjs.org', required
          - `reviewedThreats` 'complete' | 'unavailable', required
          - `packageVerdicts` 'complete' | 'unavailable', required
          - `authorVerdicts` 'complete' | 'unknown' | 'unavailable', required
          - `identity` 'known' | 'unknown', required
      - object
        - `index` integer, required
        - `inputPurl` string, required
        - `canonicalPurl` string, nullable, required
        - `status` 'no_known_malware', required
        - `reasonCodes` unknown[], required
          - unknown
        - `findings` unknown[], required
          - unknown
        - `findingsTruncated` unknown, required
        - `coverage` object, required
          - `registry` 'https://registry.npmjs.org', required
          - `reviewedThreats` 'complete', required
          - `packageVerdicts` 'complete', required
          - `authorVerdicts` 'complete', required
          - `identity` 'known', required
      - object
        - `index` integer, required
        - `inputPurl` string, required
        - `canonicalPurl` string, nullable, required
        - `status` 'unknown', required
        - `reasonCodes` string[], required
        - `findings` unknown[], required
          - unknown
        - `findingsTruncated` unknown, required
        - `coverage` object, required
          - `registry` 'https://registry.npmjs.org', required
          - `reviewedThreats` 'complete' | 'unavailable', required
          - `packageVerdicts` 'complete' | 'unavailable', required
          - `authorVerdicts` 'complete' | 'unknown' | 'unavailable', required
          - `identity` 'known' | 'unknown', required
      - object
        - `index` integer, required
        - `inputPurl` string, required
        - `canonicalPurl` string, nullable, required
        - `status` 'unsupported', required
        - `reasonCodes` string[], required
        - `findings` unknown[], required
          - unknown
        - `findingsTruncated` unknown, required
        - `coverage` unknown, required
      - object
        - `index` integer, required
        - `inputPurl` string, required
        - `canonicalPurl` string, nullable, required
        - `status` 'error', required
        - `reasonCodes` string[], required
        - `findings` unknown[], required
          - unknown
        - `findingsTruncated` unknown, required
        - `coverage` unknown, required

## Other responses

- `400`: Default Response
- `404`: Default Response
- `413`: Default Response
- `429`: Default Response
- `503`: Default Response

---

[API](https://skmtc.dev/socket-dev/apis/socket-api-v1.md) - [All operations](https://skmtc.dev/socket-dev/apis/socket-api-v1/llms.txt) - [OpenAPI document](https://skmtc.dev/socket-dev/apis/socket-api-v1/revisions/e88284728ffb?raw)