The search box on the Fallout feed accepts a small query language. Tokens are separated by spaces; keys are case-insensitive. Press Enter to submit.
| Token | Effect |
|---|---|
sha256:<hex> |
Jump straight to the file page for that SHA-256.
Alias: sha:. A bare 64-character hex string works too — paste a hash, hit Enter.
|
crit:hostile · crit:suspicious · crit:benign · crit:any |
Filter by litmus criticality band. The feed defaults to crit:hostile; use crit:any for the unfiltered view.
Also accepts numeric comparators: crit:>2, crit:>=2, crit:=3 (1 = benign, 2 = suspicious, 3 = hostile).
|
ecosystem:<name> |
Restrict to one package ecosystem (e.g. ecosystem:npm, ecosystem:pypi).
Alias: eco:. Maps to the /{ecosystem}/ URL.
|
domain:<host> |
Restrict to samples originating from one source domain (e.g. domain:pypi.org). |
m:<formula> |
Find samples sharing the same cleave malecule, e.g. m:C6H12O6.
Aliases: malecule:, molecule:, formula:. A bare formula-looking token (mixed capital letters and digits, no spaces) is treated as m:.
|
<free text> |
Anything else is matched against filename (substring, case-insensitive) and exact SHA-256.
Aliases: q:, filename:, file:.
|
crit:hostile ecosystem:npm
Hostile npm packages
ecosystem:pypi m:C6H12O6
PyPI samples sharing one malecule
crit:>2 domain:github.com
Hostile samples from github.com
requests-
Filename substring match
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Jump to that SHA-256
Picking from the Crit / Ecosystem / Domain dropdowns updates only the matching token in the search box — anything else you typed is preserved.