Safeguard publishes a public threat feed covering high-severity supply-chain CVEs, malicious-package alerts, and exploit-availability changes — free for any team to consume. RSS for humans, JSON for automation, STIX 2.1 for SIEM and TIP ingest, plus a Slack webhook you can drop straight into an incident channel.
Same content, different transports. Subscribe to whichever fits the consumer.
GET https://safeguard.sh/feed.xmlRecommended for humans and most aggregators. Standard RSS 2.0 with item-level severity, ecosystem, and CVE fields.
GET https://api.safeguard.sh/v1/threat-feed.jsonRecommended for automation. Cursor-paginated, ETag-supported, schema-versioned. Drop into a cron job and diff against last seen.
GET https://api.safeguard.sh/v1/threat-feed.stixFor SIEM and TIP ingest. Each item is a STIX 2.1 indicator bundle with relationships to vulnerability, malware, and tool objects.
GET https://safeguard.sh/threat-feed/slackDrop into your incident channel. POST an event matcher and we'll route filtered items in real time, formatted for a glanceable read.
No raw CVE firehose. Every item is filtered through the same pipeline that powers the platform — high signal, structured, prioritised for impact.
High-severity CVEs surfaced as they hit NVD and OSV, annotated with current EPSS score and a KEV flag when the CVE is on CISA's Known Exploited Vulnerabilities list.
Malware in npm, PyPI, Maven, NuGet, and crates.io as we observe takedowns, install-time hook patterns, and typosquat campaigns. Each item carries package coordinates and the trigger that flagged it.
When a public proof-of-concept is published, or when a CVE crosses the threshold to in-the-wild exploitation. Useful for prioritising fixes against active risk, not theoretical risk.
Compromised releases of widely-depended-on libraries — typically catastrophic-blast-radius events where a single bad version becomes a transitive dependency for a meaningful slice of the ecosystem.
Suspicious maintainer changes on widely-used packages — fresh accounts publishing under aged identities, dormant accounts suddenly releasing, registry-handle handoffs without provenance trail.
When Safeguard's research team publishes an advisory, the same item appears on the feed with the CVE, ecosystem, and link to the full write-up on /research.
Every JSON item carries the fields below. STIX wraps the same payload in an indicator bundle; RSS flattens it into channel items with extension namespaces.
{
"id": "sg-tf-2026-09812",
"published_at": "2026-04-28T14:22:11Z",
"title": "Unsafe deserialization in popular Node logging library",
"ecosystem": "npm",
"severity": "critical",
"cve": "CVE-2026-12345",
"epss": 0.86,
"kev": false,
"affected_versions": ">=3.0.0 <4.2.1",
"fixed_versions": ">=4.2.1",
"suspected_malicious": false,
"source": "safeguard.research",
"references": [
"https://safeguard.sh/research/cve-2026-12345",
"https://nvd.nist.gov/vuln/detail/CVE-2026-12345",
"https://osv.dev/vulnerability/CVE-2026-12345"
]
}Schema is documented in the threat-feed README; all fields are stable across the v1 cutover.
The feed is free for any team to consume — startup, enterprise, hobbyist, or academic. Attribution is required when you republish derived content: Source: Safeguard Threat Feed, https://safeguard.sh/threat-feed. Commercial redistribution as a standalone product requires written permission. The feed is provided without warranty; verify items against your own threat model before acting on them.
Subscribe in the shape that fits your stack. Need the same signal scoped to your SBOM? That's what the platform does.