abuse.ch SDK

JavaScript/TypeScript client for abuse.ch APIs — the largest open-source malware threat intelligence platform. 1.5M+ malware samples, 3M+ malicious URLs, IOC sharing.

| API | Module | Status | |-----|--------|--------| | MalwareBazaar | abusech-sdk/malwarebazaar | ✅ 25 methods | | URLhaus | abusech-sdk/urlhaus | 🔜 planned | | ThreatFox | abusech-sdk/threatfox | 🔜 planned |

Zero dependencies. Works on Bun, Node.js, Deno, Cloudflare Workers.

bun add abusech-sdk
# Register at https://auth.abuse.ch/ for free API key
export ABUSE_CH_KEY=your-key

Quick Start

import { MalwareBazaar } from 'abusech-sdk/malwarebazaar';

const mb = new MalwareBazaar(process.env.ABUSE_CH_KEY);

// Latest tagged malware (24h)
const detections = await mb.recentDetections({ hours: 24, limit: 50 });

// Sample metadata by hash
const info = await mb.searchByHash('46faab8ab153fae...');
console.log(info.signature, info.file_type, info.tags);

// Download a sample (zip, password: "infected")
const bytes = await mb.downloadSample('46faab8ab153fae...');
await Bun.write('/tmp/malware.zip', bytes);

// Search Shai-Hulud samples
const shai = await mb.searchByTag('Shai-Hulud', 100);

// Fuzzy hash search
const byImphash = await mb.searchByImphash('f34d5f2d4577ed6d');

CLI

bun src/cli.js hash 46faab8ab153fae...
bun src/cli.js download 46faab8ab153fae... ./malware.zip
bun src/cli.js recent 24 50
bun src/cli.js tag Shai-Hulud 100
bun src/cli.js sig TrickBot 50
bun src/cli.js type elf 20

API Reference — MalwareBazaar

Constructor

const mb = new MalwareBazaar(apiKey, {
  baseUrl: 'https://mb-api.abuse.ch/api/v1/',  // default
  timeoutMs: 60000,                              // AbortController timeout
  fetch: customFetch,                            // for CF Workers
});

Core (2 methods)

| Method | Description | |--------|-------------| | searchByHash(hash) | SHA256/SHA1/MD5 → full metadata + vendor intel | | downloadSample(sha256) | Raw zip bytes (PW: infected) |

Listings (2)

| Method | Description | |--------|-------------| | recentDetections({hours, limit}) | Tagged malware (last N hours) | | recentAdditions(selector?) | Latest uploads |

Search by Metadata (4)

| Method | Query | |--------|-------| | searchByTag(tag, limit) | get_taginfo | | searchBySignature(sig, limit) | get_siginfo | | searchByFileType(type, limit) | get_file_type | | searchByClamAV(sig, limit) | get_clamavinfo |

Fuzzy Hashes (5)

| Method | Hash Type | |--------|-----------| | searchByImphash(h, limit) | PE imports hash | | searchByTLSH(h, limit) | Trend Micro TLSH | | searchByTelfhash(h, limit) | ELF hash | | searchByGimphash(h, limit) | Go binary hash | | searchByDhashIcon(h, limit) | PE icon dhash |

YARA & Certificates (4)

| Method | Query | |--------|-------| | searchByYARA(rule, limit) | YARA rule hits | | searchByCertificateIssuer(cn, limit) | Signing cert issuer | | searchByCertificateSubject(cn, limit) | Signing cert subject | | searchByCertificateSerial(sn, limit) | Signing cert serial |

Write Operations (3)

| Method | Description | |--------|-------------| | uploadSample(bytes, opts) | Upload + metadata (multipart) | | updateEntry(sha256, fields) | Update tags/signature | | addComment(sha256, comment) | Add analyst comment |

Blocklist (1)

| Method | Description | |--------|-------------| | getCSCB() | Code Signing Certificate Blocklist |

License

MIT © gutem