THREAT INTEL FEED
The threat intel feed, as its own product
Every package published to npm passes through the sandbox, so the byproduct of running Cohen is a long, dense record of what malicious packages actually did, not just that they were bad. Observatory is that record, sold as data.
It reads, and only reads, from work already done. It ships without the scanner and stands on its own: real time, with the full history behind it.
Command and control
Every IP and domain a package opened a connection to, with the package and version that reached for it.
Hashes
SHA256 for every file in every analysed tarball, including dropped binaries that never appeared in the repository.
Filesystem artifacts
Paths read, written and made executable. The credential files targeted, the temporary directories used, the archive names chosen.
Real time
Verdicts land as the registry publishes, not after an advisory is written. Historical archive included.
HOW IT WORKS
Where the records come from
Observatory is not a separate pipeline. It is the same sandbox the scanner uses, with its output kept rather than discarded once a verdict is issued.
Publish
A version lands on npm. The registry firehose reaches the queue within seconds.
Run
It is installed and imported in a fresh sandbox under full system call tracing.
Extract
Connections, hashes, paths and process trees are lifted out of the trace as structured fields.
Correlate
Records are joined across packages, so one C2 address surfaces every version that reached for it.
Deliver
The record hits the API, the webhook and the bulk sync at the same moment.
IN PRACTICE
One record, exactly as it arrives
Every field is attributed. A connection is never reported without the process that opened it, which is the part an advisory cannot give you.
{
"package": "polymarket-stake-mathss",
"version": "3.5.2",
"verdict": "review",
"first_seen": "2026-08-31T09:14:22Z",
"connections": [
{ "host": "45.61.136.12", "port": 443, "by": "node postinstall.js" },
{ "host": "api.telemetry-cdn.link", "port": 443, "by": "curl" }
],
"files_read": [
"~/.aws/credentials", "~/.npmrc", "~/.ssh/id_ed25519"
],
"processes": [ "node", "sh", "curl", "tar" ],
"hashes": [
{ "path": "lib/index.js", "sha256": "9f2c1e...a load of hex" },
{ "path": "bin/.helper", "sha256": "41ab77...a load of hex", "dropped": true }
],
"elapsed_ms": 10500
}
// 1 of 3,412 records in this window
verdictEither review or clean. Every analysed version carries one, which is what makes the feed usable as a baseline rather than only a blocklist.
connections[]Host, port and the process that opened it. The attribution is the point: you get the code that reached out, not just the address.
files_read[]Paths touched during install and import, with the credential locations flagged separately.
hashes[]SHA256 per file, with dropped set on anything that was never in the published repository.
first_seenWhen the sandbox finished, not when an advisory was published. Usually the earlier of the two by a wide margin.
OBSERVATORY PRICING
Priced separately, sold on its own
Observatory does not require a Cohen scanner subscription. Attach it to any plan, or take it alone.
QUESTIONS
Before you wire it in
Do I need the scanner to buy the feed?
No. Observatory is sold on its own and bills on its own. If you already pay for the scanner it attaches to that account, but nothing requires it.
How real is real time?
The run starts within seconds of publication. A record lands when the sandbox finishes, which is minutes rather than the days an advisory takes.
Does it carry clean packages too?
Yes, and that is deliberate. A feed of only the bad ones tells you nothing about the 98 percent, so every analysed version is published with its verdict.
Live feed only, or the history as well?
Both. Bulk sync ships the archive in one pass, the webhook carries whatever is new from that point on.
What formats does it deliver in?
REST and webhook push as standard. STIX and TAXII for anything that has to land in a SIEM without a translation layer in between.
Can I attribute an indicator back to the code?
Every field carries the package, the version and the process that produced it. That is the whole reason the record is worth more than the verdict.