Top Threat Intelligence Feeds for Open-Source Supply Chain Security
Summary
The guide compares five feeds for malicious packages and vulnerabilities, outlining their coverage, detection timing, access, and enforcement. It also offers practical criteria for selecting feeds and discusses limitations in public vulnerability data.
Key points
- The article distinguishes malicious packages from vulnerabilities in legitimate code, noting that malicious packages may be removed before CVE-based sources report them.
- It compares Aikido Intel, Socket Threat Feed, Snyk Security Database, OSV.dev, and Spectra Intelligence, including their coverage, access models, and stated limitations.
- Aikido says Intel covers more than four million open-source packages across 20 ecosystems and uses behavioral analysis, sandboxing for npm packages, and researcher review.
- The article says Socket flags suspicious package behavior before human review, which can speed alerts but may lead to legitimate packages being labeled incorrectly.
- Its selection checklist covers pre-disclosure detection, coverage beyond registries, feed speed and false positives, API access, install-time enforcement, and remediation support.
- The article states that NIST’s NVD now prioritizes certain CVEs, leaving some entries without independent analysis or enrichment.
Article Details
- Topic
- Open-source package threat intelligence feeds and supply-chain malware detection
People
Vendors
AikidoAugust's compromise of keyv, a caching library with roughly 127 million weekly downloads. In Q2 2026, Aikido Intel confirmed 19,500 malicious packages.GoogleWhat it does: A free, Google-run vulnerability database and API. It aggregates advisories from GitHub Security Advisories, PyPA, RustSec, Go, and many Linux distributions into the open OSV schema.ReversingLabsSpectra Intelligence (ReversingLabs): Best for regulated teams that need forensic depth on binaries and artifactsSnykSnyk Security Database: Best for teams already standardized on Snyk who want vulnerability intelligence inside their existing scannersSocketSocket Threat Feed: Best for teams focused on package behavior at the PR and install layer
Products
Aikido IntelAugust's compromise of keyv, a caching library with roughly 127 million weekly downloads. In Q2 2026, Aikido Intel confirmed 19,500 malicious packages.Aikido Librariesenriching vulnerabilities, Intel sends the relevant findings to the patch-building pipeline to power Aikido Libraries. Aikido customers receive the fix as a patched, compatible variant of the same package version,Device Protection✅Safe Chain, Device ProtectionOSV.devOSV.dev: Best as a free reference for disclosed vulnerabilities and reported malwareSafe ChainAikido Intel: Surfaces pre-CVE and undisclosed vulnerabilities alongside malware in one feed, available through an API and Safe Chain's install-time blockingSnyk Security DatabaseSnyk Security Database: Best for teams already standardized on Snyk who want vulnerability intelligence inside their existing scannersSocket Threat FeedSocket Threat Feed: Best for teams focused on package behavior at the PR and install layerSpectra Assurepricing is enterprise-only. ReversingLabs packages its software supply chain analysis separately, in Spectra Assure. Expect integration work to get value beyond hash lookups.Spectra IntelligenceSpectra Intelligence (ReversingLabs): Best for regulated teams that need forensic depth on binaries and artifacts
Tools
Opengrepout: Aikido Intel analyzes what package code does. New packages are deobfuscated and checked against Opengrep and YARA-X rules. npm packages are also detonated in a sandbox. AI traces behavior across files, andOSV-Scannerpositives compared with CPE-based matching. It's easy to query in CI and pairs with the open source OSV-Scanner. It also includes malicious package reports from the OpenSSF Malicious Packages project.YARA-XIntel analyzes what package code does. New packages are deobfuscated and checked against Opengrep and YARA-X rules. npm packages are also detonated in a sandbox. AI traces behavior across files, and anything it