malicious-software-packages-dataset · Index

2025-03-31-@sas-dvr_nova-crossorigin-auth v132.0.0 Apr 24 malicious-software-packages-dataset

5806b3f944c8bc2b053b484f4d6ee79a4d2685c95b61f64b24df9e94d6faa122 O₄(Eu₂S₇Dy₃C)H₄(Cm₄Db₅Os₃Po₃)Md₂(InPa₅)

100% Exfiltrates env to OOB domain

2025 05-11-blog-client-v1.0.0 Apr 24 malicious-software-packages-dataset

5f12fbcb65b277d6c752cd7a858a499e418382e5063c6172da710a750c5402da O(S₃)H₃(Cm₃Db₂Po₂)Md₂(InPa)

100% DNS exfiltration of system data

2024 12-03-olivergreen-v2.1.1 Apr 24 malicious-software-packages-dataset

666ed01605f1d3abea9138b8e01130fb08446e6f15514682825c79c5602ffbce H(Db₂)

33% Encrypted archive members

2025 06-27-cf-install-v99.99.2 Apr 24 malicious-software-packages-dataset

6944dfbe4b1b7b9e2fd5ae650e746a6e88c94983c1afdb5f4e453bedfee395f5 O(S₇)H(Db₂)Md(Pa₅)

100% Exfiltrates system info via install hooks

2025 08-27-com.unity.editor.tasks-v10.0.1 Apr 24 malicious-software-packages-dataset

77f85778d5dc306e9259322589021e3d770a7d1c716bda78c2203fbba03420df O₂(S₆Eu)H₂(Db₂Po₂)Md(Pa₃)

100% preinstall exfiltrates system info

2025-09-20-@winstan_vinston v1.0.0 Apr 24 malicious-software-packages-dataset

cf70c1a19664eedebda175461b074aea73d3cac0adf66ec7096ef0d4ecfc00fd O₃(CXeS)H₅(Cm₇Db₇F₆Os₃Po₈)Md₂(InPa₂)

98% Decrypts and executes hidden PE payload

2025 07-22-jcl-over-slf4j-v1.7.25 Apr 24 malicious-software-packages-dataset

94fc910f14f89e98d472b29ddc8aff95934de29d636ba40c2de0b53770b90eda O₃(Eu₃S₄C)H₄(Cm₄Db₃Os₄Po)Md₂(InPa)

100% Exfiltrates system data via postinstall

2025 09-29-redirect-sjcr8c-v1.0.0 Apr 24 malicious-software-packages-dataset

ba94f92d48956924db6760da8ab7a321337cdbe4098e7f4f7a5dfa6b88e6188d K₂(LiTe)O(Xe)H₆(Cm₅Db₅F₄Os₂Po₄U₂)Md₂(Pa)

99% Malicious npm redirect package

2025 11-28-vdous-v1.0.1 Apr 24 malicious-software-packages-dataset

ef47741b64103b6613a30572711c908502af0a30b2d01e0d99e84787151cbc5c O(S₂)H₃(CmDb₂Po₂)Md₂(InPa₂)

98% Preinstall hook opens browser

2026 04-05-chai-use-chains-v1.2.6 Apr 24 malicious-software-packages-dataset

139b0b9bbc16350143e919d7d18996d42f62cc65fcf48761ddc919a8117fd9d6 K(Li)O₃(C₃As₂S)H₅(Cm₉Db₇OsPo₈Ti)Md₄(InLiPa₃)

100% Remote code execution via C2

2025 06-02-lib-wallet-pay-btc-v1.0.0 Apr 24 malicious-software-packages-dataset

29bade7dfa3ad65642c10a15b17a87df68c463de91c94b3d9ab6221fefaa270a O₂(S₇Eu)H₂(CmDb₂)Md(Pa₄)

100% preinstall exfiltrates system info

2024 09-24-tannucolingboys-v99.0.0 Apr 24 malicious-software-packages-dataset

42903eb4996c993a28548035efe568788180018c750eb1a1bb7901c030f064c1 O₄(Eu₃S₉Dy₃C₂)H₅(Cm₁₃Cr₄Db₇Os₂Po₉)Md₅(Pa₅Bi₂BkHeIn)

100% Exfiltrates system info, downloads malicious script

2024 11-18-take2-hello-world-v1.0.0 Apr 24 malicious-software-packages-dataset

48c0bf2ed0c02d514da86431ede36a3772c1a6a3890cb187a22ee0557315eb4e O₂(S₇Eu)H₃(CmDb₂Po)Md(Pa₄)

100% preinstall downloads and runs xmrig miner

2025 03-05-electron_npm_deps-v9.9.9 Apr 24 malicious-software-packages-dataset

4e224b8c17c8765642cd5e200e13a5dc1557f0c470970d059ba9505b26cc152b O₂(S₅Eu)H₂(CmDb₂)Md(Pa₄)

100% Exfiltrates /etc/passwd via preinstall

2025 05-04-crisp-import-conversations-v1.8.2 Apr 24 malicious-software-packages-dataset

521155b1deae188233a95b6817bf32f72d6ff4fd900c7aa38efa6e27c6118c8f K(Am)O₂(S₆Eu)H₄(Cm₉Db₅Os₂Po₂)Md₂(InPa₃)

100% Exfiltrates system info to Discord

2025 08-12-durablefunctionsmonitor-vscodeext-v0.1.3 Apr 24 malicious-software-packages-dataset

7ed0963b472a4e7343999ae9f26c57103e9c3bf8d160277fe95ce4adc8a6277a O(S₂)H(Db₂)Md(Pa₄)

100% Malicious npm dependency URL

2025 05-25-whatwg-node-v1.0.0 Apr 24 malicious-software-packages-dataset

86565b532144a5b754cc8e4170d546e42928e3b645b0dea109483d33af254fc2 O₄(Dy₃Eu₂S₃Er)H₄(Cm₃Db₆Os₄Po₆)Md(In)

100% Exfiltrates system info to hardcoded IP

2025-09-11-@openzeppelin-compact_utils v0.24.0 Apr 24 malicious-software-packages-dataset

915a2c630c811737bcf49ea02e6f941a936c1d76233f71308dde24f5880c134a O(S₂)H(Db₂)Md(Pa₄)

100% Typosquatting, malicious HTTP dependency

2024-12-04-@aftersale_react-eva v1.1.1 Apr 24 malicious-software-packages-dataset

9553d3e2f6ffcf3864f9b4f34976ad7d4bf924066e744b0bbff9c41cbc7bfdf2 O₄(Eu₃S₈Dy₃C)H₄(Cm₅Db₃Os₂Po₃)Md₂(InPa₂)

100% Exfiltrates system info to OOB domain

2024 12-22-widgets-mainappointments-v2.6.0 Apr 24 malicious-software-packages-dataset

d173f90241b8fc0dcebf75555c765db886e8fa9a76eab691249e8b10e02a476c O₄(Eu₃Dy₃S₄C)H₅(Cm₆Db₂F₃Os₂Po₂)Md(In)

100% Exfiltrates system data to OOB

2025 01-23-ebay-tester-v999.9.9 Apr 24 malicious-software-packages-dataset

d2f27f5c2d07500ba02813c870e3a97e91e2e14c7033c921bd33546ee42faade O₃(S₇DyEu)H₄(Cm₈Db₄Os₂Po₂)Md₂(Pa₄In)

100% DNS exfiltration via Oastify

2025 05-22-service-config-provider-v2.0.0 Apr 24 malicious-software-packages-dataset

ff901136e937f02bd82320f9db8300b00b310842ca93e31edc06919e57c990b0 O₄(S₆CDy₃Eu)H₄(Cm₁₂Db₅Os₆Po₂)Md₂(InPa₅)

100% Exfiltrates system info to hardcoded IP

2025 12-11-mw-proto-ts-v99.99.1 Apr 24 malicious-software-packages-dataset

027d05d5964561d2b71370a50f1ef9fe13e95605b61f807fb0cc96e0ee142c0f O(S₇)H(Db₂)Md(Pa₅)

100% Exfiltrates system info via install hooks

2025 12-09-libxmljs21471479-v0.30.2 Apr 24 malicious-software-packages-dataset

389d41ab63d80c24860190ba19923cb29ae2a60b33a7222130a51676bee950ca O₂(CS₄)H₅(Cm₆Db₃F₃OsPo₂)Md₃(InPa)

100% Exfiltrates data to hardcoded IP

2025 12-03-elf-stats-storybook-marshmallow-471-v1.0.0 Apr 24 malicious-software-packages-dataset

83c6b4f59eca984ca212526d551df27734d05af45e0952826f048e5f6b10e690 O₂(C₂S₄)H(Db₂)Md(Pa₃)

100% preinstall reverse shell to C2

2025 06-16-next-typescript-mercadolibre-v55.3.55 Apr 24 malicious-software-packages-dataset

28961aed971e77b092dd01553a6d707e809927b308a209241fdf09b2480fb5bc K(Mc)O₅(Eu₆S₁₁AsAlDy₂)H₆(Cm₆CrDb₇FOs₃Po₄)Md₂(Pa₈In)

100% DNS exfiltration of system data

2026 02-27-securefiles-common-v1.0.1 Apr 24 malicious-software-packages-dataset

a6e674063665003be9a40736a547f56afcd596fcc36c4d97a4238f7918728430 O₄(Eu₃S₇Dy₃C)H₄(Cm₅Db₃Os₂Po₂)Md₂(InPa₃)

100% Exfiltrates system info to OOB endpoint

2026-01-18-@wbgo_shared v99.99.10 Apr 24 malicious-software-packages-dataset

aeeda24b023ae71ab986664d290f411f2044e3c80ddc6b9482dbad230181d5fb O(S₂)H(Db₂)Md(Pa₆)

67% Suspicious metadata and encrypted archive

2025-06-01-@seo-frontend-components_card-blog-carousel-mobile v1.999.2 Apr 24 malicious-software-packages-dataset

b3e110828a423d2f358e7026d98d68a1beb5d70a8faec8e71ef4f426d894ab88 O(S₃)H₃(CmDb₃Po₂)Md₂(InPa₅)

98% preinstall hook exfiltrates host data

2025-05-31-@seo-frontend-components_card-blog-carousel-mobile v1.999.0 Apr 24 malicious-software-packages-dataset

ca9a68b2d444594a5dc0c10639317f381b169428cccc85d110fbef341de86fca O(S₃)H₃(CmDb₃Po₂)Md₂(InPa₅)

98% preinstall hook executes malicious payload

2025 02-27-react-content-loader-fork-v4.4.4 Apr 24 malicious-software-packages-dataset

d41eba7b1daef41b7e122162303c785781f794e47918712e1b68a62e9ce9ca78 O₄(CEuS₄Dy₃)H₄(Cm₁₉Db₅Os₄Po₂)Md₂(InPa₃)

100% Exfiltrates system info to hardcoded IPs

2025 08-28-azure-functions-templates-build-v1.0.0 Apr 24 malicious-software-packages-dataset

e22e06ab9ee45abb010aba69157a44f7e59f93f8e51c78b160a0a9a5ed94ea10 O(S₄)H₃(Cm₂Db₃Po₃)Md₂(InPa₂)

100% preinstall exfiltrates system info

2025 10-08-v0-utils-v999.999.15004 Apr 24 malicious-software-packages-dataset

0f8395e07fc836c2c4a0116af0304aacf1e7dc61da1071cd68d1be2725c037c6 O₄(S₆Ca₂AlEu)H₅(Cm₄Db₄F₄Os₃Po₃)Md₂(Pa₄In)

100% Exfiltrates credentials to OOB server

2025 11-26-dotnetenv-v1.1.7 Apr 24 malicious-software-packages-dataset

12be1e264aa737de57be0828bff9ad33227fed9f430b8e553e6b4dc5d1df9cc7 K₂(McLi)O₅(As₇Dy₃CoSXe)H₆(Cm₁₀CrDb₁₄Os₅Po₈Ti)Md₃(InLiPa₃)

100% Obfuscated malware exfiltrates system data

2024 12-01-language-babel-v10.4.1 Apr 24 malicious-software-packages-dataset

14827c29e69d7f6b17bfc5a862842ec15fcb6708a45ae1db5db4c6156c239d60 K(Am)O₃(EuS₇Dy₄)H₄(Cm₁₀Db₄Os₃Po₃)Md₂(InPa₂)

100% Exfiltrates system data to Discord

2025 06-06-ach-spa-facephi-v99.9.1 Apr 24 malicious-software-packages-dataset

15b463f6f6517316ef91d8f5b86b961bcc67f5ec302a285ca0d11417582b086d O₃(S₃Eu₂Dy)H₄(Cm₆Db₅Os₂Po₂)Md₂(Pa₆In)

100% preinstall exfiltrates data to OOB

2025 10-08-v0-utils-v999.999.10004 Apr 24 malicious-software-packages-dataset

1faeff94fb7a169b57b3cf12aa8806570821618713f71b4e86be09e4aec31723 O₄(S₅Ca₂AlEu)H₅(Cm₄Db₄F₃Os₂Po₃)Md₂(Pa₄In)

100% Exfiltrates npm credentials to OOB

2025 01-08-operaextensions.js-v9.9.9 Apr 24 malicious-software-packages-dataset

28b86bc387ae7f18842c0ec2343aa2736ed096c249f080e5ad36a1dbd9b6ab69 O₂(S₆Eu)H₂(CmDb₂)Md(Pa₄)

100% preinstall exfiltrates system info

2025 10-08-v0-utils-v999.999.23004 Apr 24 malicious-software-packages-dataset

2fd68031ab62d7930f1a7db7817227e7b8b647387fed28e07485c0beb52ef6c0 O₃(S₄AlEu)H₅(Cm₄Db₃FOs₂Po)Md₂(Pa₄In)

100% Exfiltrates environment variables to OOB domain

2025 10-08-v0-utils-v999.999.21004 Apr 24 malicious-software-packages-dataset

424f0910e55e47e2ab646cf1f9369642a0b3bd24c40b2b3f490ecae0356149db O₃(S₄AlEu)H₄(Cm₅Db₄OsPo₂)Md₂(Pa₄In)

100% Exfiltrates data via OOB domain

2025 12-06-dubbo-js-private-workspace-v999.0.104 Apr 24 malicious-software-packages-dataset

4362f65c28b4fbdba61de10eaacf658b24c0100a7703ed9303cdd2d43fcd0357 O(S₆)H₄(Cm₂Db₅Os₂Po₃)Md(Pa₄)

100% Exfiltrates system info via obfuscated HTTP

2025 10-08-v0-utils-v999.999.11004 Apr 24 malicious-software-packages-dataset

45b9d25e4f3a5fd06484b1ff37e0a8b78a955f5b98cefb41eccf33b1047c97a5 O₄(S₆Ca₂AlEu)H₅(Cm₄Db₄F₄Os₂Po₃)Md₂(Pa₄In)

100% Exfiltrates credentials to OOB server

2025 10-08-v0-utils-v999.999.5004 Apr 24 malicious-software-packages-dataset

506e125fbc567cd579bd882d0c47e2c2c8df2b7bf5168017d3e2f5f269aa901d O₄(Eu₂S₁₂AlDy)H₄(Cm₈Db₅Os₂Po₂)Md₂(Pa₄In)

100% Exfiltrates system info to OOB domain

2025 02-17-jaas-jwt-v2.0.0 Apr 24 malicious-software-packages-dataset

5548ab155d08ccb9b3ea4c275f97aca2eb947cc73136515d9796348835d4ea98 O₄(Eu₃S₈Dy₃C)H₅(Cm₆Db₃F₃Os₂Po₃)Md₂(InPa₂)

100% Exfiltrates system data to OOB

2025 10-08-v0-utils-v999.999.20004 Apr 24 malicious-software-packages-dataset

58a83856cd5062f47ff7c5c3157dca5b150b732da8e450d8a26d5883bb344e8f O₃(S₄AlEu)H₃(Cm₄Db₃Po)Md₂(Pa₄In)

100% preinstall exfiltrates to OOB

2025 10-08-v0-utils-v999.999.999 Apr 24 malicious-software-packages-dataset

5cc79016ab95a1d3de61dc490c06a87cc549a0265ec96e034c7269b3e8c7ca4d O₃(Eu₂S₆Al)H₄(Cm₃Db₆Os₃Po)Md₂(Pa₅In)

100% Exfiltrates host info via preinstall

2025 07-21-safe-chain-test-v1.0.1 Apr 24 malicious-software-packages-dataset

745dcaecae00f79fb7ce7c14f1600824a2621f43a8f867ea54d5287b491e9935 O(Dy)H₄(Cm₃Db₃Os₂Po₂)Md₂(InPa₂)

65% Explicitly harmless test package

2025 08-10-protect-and-track-v1.9.0 Apr 24 malicious-software-packages-dataset

8ee4f62201fc58b5900e46d46a360fbcd193bb0fe15edf50ab2d7fba8a419453 O₂(S₆Eu)H₂(CmDb₂)Md(Pa₂)

100% preinstall exfiltrates /etc/passwd

2025 11-17-node-calculator-feea-v1.0.0 Apr 24 malicious-software-packages-dataset

9b416a84f3f195899d8aa4e0373b3ab60ba609ab4f04d51ac6056676f44f39fe K₂O₁₀(S₁₉Ca₂Er₂EuXe₂As₄C₃DyIP)H₄(Cm₂DbFPo)Md₃(InPa₄Li)

2025 10-08-v0-utils-v999.999.9704 Apr 24 malicious-software-packages-dataset

a683006d3d5f85c2b59f555731f6e9f278cd265aac75d440c34a5a246745f09d O₃(S₄AlEu)H₄(Cm₅Db₃Os₂Po₂)Md₂(Pa₄In)

100% Exfiltrates env vars to OOB

2025 12-03-elf-stats-sprucey-train-710-v1.0.1 Apr 24 malicious-software-packages-dataset

ab3c2eb9582b81de9d2ad4393acca3216e2c1334e591b13e08eebe53c06825ac O₂(EuS₅)H₄(Cm₇Db₂OsPo₃)Md₂(Pa₃In)

100% Exfiltrates data via curl POST

2025-06-18-@saas2_utils v9.8.1 Apr 24 malicious-software-packages-dataset

bb69dca4750c13c77a3f1e5b2adc95f74a6d9072a2333dd627399aa052652ff0 O₃(Eu₃Dy₃S₆)H₅(Cm₁₂Db₆FOs₅Po₃)Md₂(InPa₂)

100% DNS/HTTP data exfiltration in postinstall

2026 04-01-shoal-cli-v0.4.1 Apr 24 malicious-software-packages-dataset

c42260ef18623ad0e1b756ca57e76eeb744f2d8200323ea672b717aff3ebe528 O(S)H₄(Cm₁₂Db₅OsPo₄)Md(Pa)

80% postinstall runs npx, encrypted zip

2025 07-29-plugin-commonjs-v9.1.1 Apr 24 malicious-software-packages-dataset

c63684a6a6acf460315c01cdb7a3abb1c11057c9a9d242122709bcc181e6ad9b O₅(Ca₂Eu₄S₅CDy)H₅(Cm₄Db₄F₅Os₅Po₄)Md₂(InPa)

100% Exfiltrates system data to OOB

2025 10-08-v0-utils-v999.999.4004 Apr 24 malicious-software-packages-dataset

c678997936654c91e1d6a9f63b0b7db784f1cf78131ab0660c65bafb18e115a6 O₄(Eu₂S₈AlDy)H₄(Cm₄Db₆Os₂Po₂)Md₂(Pa₄In)

100% Exfiltrates system info to OOB domain

2026 04-12-shoal-cli-v0.4.3 Apr 24 malicious-software-packages-dataset

df9eff18799d6c6fe1cf4b282389fe0bc0903227317951d7abb87114bfff6184 O(S)H₄(Cm₁₂Db₅Os₂Po₄)Md(Pa)

79% postinstall executes remote code

2026 04-12-shoal-cli-v0.4.2 Apr 24 malicious-software-packages-dataset

e70978fc5e1494eb3612c1bef2594a8ac008f2cd28c630fbfab5f125d7e7415a O(S)H₄(Cm₁₂Db₅Os₂Po₄)Md(Pa)

77% postinstall hook, .xyz domain, npx exec

2024 12-31-node-validators-v1.1.4 Apr 24 malicious-software-packages-dataset

ea787810ff7df5b215203d1614f0cc125ad7576461060cd93c370a34fd2d3965 K₂O₉(EuS₁₃As₄C₄Xe₂Ca₂Er₂ILa)H₅(Cm₂Cr₃Po₂Db₄Os)Md₂(Pa₅)

2025 10-08-v0-utils-v999.999.2004 Apr 24 malicious-software-packages-dataset

f42bef2940563c7c3408266a081877c455f4f78178e012c653ca1317f2f51e59 O₄(Eu₂S₇AlDy)H₄(Cm₅Db₆Os₃Po₂)Md₂(Pa₅In)

100% Exfiltrates system info to webhook.site

2025 10-08-v0-utils-v999.999.9004 Apr 24 malicious-software-packages-dataset

f786fd7d241ee09c1b5ae2451744cb4b4a15291d5e0963f1dbdbd528acb69a0e O₄(Eu₂S₆AlDy)H₄(Cm₆Db₄Os₃Po₂)Md₂(Pa₄In)

100% Exfiltrates environment variables to OOB domain

2024-12-19-redux-form-v5 v1.0.0 Apr 24 malicious-software-packages-dataset

0913b097fe5b23650e5c50c860211265f7abc48de02811b9e002fdf75bcdd776 O₄(Eu₄S₈Dy₃C)H₄(Cm₅Db₃Os₂Po₃)Md₂(InPa₄)

100% Exfiltrates system info to OOB domain

2024 12-14-bounty123ay-v1.0.6 Apr 24 malicious-software-packages-dataset

23f85f9846773144c33f55c2863e934ddc73fd092765f72700ba621834e3c776 O₂(S₁₀Eu)H(Db₂)Md(Pa₅)

100% Preinstall exfiltrates hostname to OAST

2025 03-19-airbnb-dev-v6.0.0 Apr 24 malicious-software-packages-dataset

64ef59c236f5ea83b091815961c56f98208a3be601b1a747f98803df02b33d2f O₄(CEuDy₃S₄)H₄(Cm₁₇Db₅Os₅Po₂)Md₂(InPa₅)

100% Exfiltrates system info to hardcoded IPs

2025 03-19-airbnb-dev-v0.6.0 Apr 24 malicious-software-packages-dataset

77311b231a98cc088e5fc700dc6813052e69f888dea6c56f6082fb51bbddd483 O₄(CEuDy₃S₃)H₄(Cm₁₇Db₅Os₅Po₂)Md₂(InPa₅)

100% Exfiltrates system info to hardcoded IPs

2025 03-19-airbnb-dev-v99.9.3 Apr 24 malicious-software-packages-dataset

a94b0ff3e0fdd9a028c45a9765d26255033f1a41de73b3003101fbfaff307e28 O₄(CEuDy₃S₄)H₄(Cm₁₇Db₅Os₅Po₂)Md₂(Pa₇In)

100% Exfiltrates system info to hardcoded IPs

2026 02-02-js-unpack-v1.1.8 Apr 24 malicious-software-packages-dataset

d354bf1295dd04df9e2073fd488ca6583be5ea33eda7c1f15882a70291b69d97 K(Li)O₃(As₄Dy₃S)H₅(Cm₇Db₉Os₅Po₈Ti)Md₄(InLiPa₃)

99% Exfiltrates system data to remote server

2025 03-19-airbnb-dev-v8.8.0 Apr 24 malicious-software-packages-dataset

df29b50992e1ae429dada5165af0180026efd2a9b20aef7ca3c0dfe099cfe37a O₄(CEuDy₃S₄)H₄(Cm₁₇Db₅Os₅Po₂)Md₂(InPa₅)

100% Exfiltrates system info to hardcoded IPs

2025 03-19-airbnb-dev-v4.2.2 Apr 24 malicious-software-packages-dataset

dff7d2cbc50c55323429e3ce97f0a29c1d3e06cd706196f801ac0fe127113b59 O₄(CEuDy₃S₄)H₄(Cm₁₇Db₅Os₅Po₂)Md₂(InPa₅)

100% Exfiltrates system info to hardcoded IPs

2025 08-03-cycalculator-ye51-v2.2.0 Apr 24 malicious-software-packages-dataset

e4c757b80cede1b1d0e44dfb911ea03a2bb19419968d120b5ab91b079f61c79c O₄(S₄CaCEu)H₃(Cm₄Db₃Po)Md₂(InPa₂)

100% Exfiltrates environment variable to OOB domain

2025 02-28-morganstanley.github.io-v2.1.0 Apr 24 malicious-software-packages-dataset

f1897f275a013f841af340f0d59f9c3cae87badaafe00445c56520b8968faaca O₄(Eu₃S₇Dy₃C)H₄(Cm₅Db₃Os₂Po₃)Md₂(InPa₃)

100% Exfiltrates system info to OOB domain

2025 03-19-airbnb-dev-v3.791.0 Apr 24 malicious-software-packages-dataset

f6433cc3bcc92cdcb5f6fd662c569c4d2e07a33c2e4e5bda2e32b6c1d7cc58fc O₄(CEuDy₃S₄)H₄(Cm₁₇Db₅Os₅Po₂)Md₂(InPa₅)

100% Exfiltrates system info via preinstall

2025 03-19-airbnb-dev-v0.0.1 Apr 24 malicious-software-packages-dataset

f6fc9b7186674bd8d41824fd7a58c97ef98e9f67225c7175f6e4a6eb776d2cb3 O₄(CEuDy₃S₄)H₄(Cm₁₇Db₅Os₅Po₂)Md₂(InPa₅)

100% Exfiltrates system info via preinstall

2025-12-14-@ikarem_telemetry v100.0.4 Apr 24 malicious-software-packages-dataset

0caf2fda912861cd0cae482e8d65884de7f2c6129c00f5549e3759454841b8f1 O(S₅)H₂(Db₃Os)Md(Pa₇)

100% Preinstall exfiltrates system info

2025 09-24-vault-hux-common-v9000.0.0 Apr 24 malicious-software-packages-dataset

0d4b69b1fcd845d4725a450d02508909f2de2af3b0218c327e48834ef2c1f61b O₄(Eu₂S₃CDy)H₄(Cm₃DbOsPo₂)Md₂(Pa₅In)

100% OOB exfiltration via preinstall hook

2025-12-19-@ikarem_telemetry v100.1.3 Apr 24 malicious-software-packages-dataset

108e9a149e06db9e292bc422f9893880b1cf4609cda855fadfd737d675a7e20d O(S₇)H₂(Db₃Os)Md(Pa₇)

100% Preinstall exfiltrates system info

2025-12-14-@ikarem_telemetry v100.0.2 Apr 24 malicious-software-packages-dataset

156260d7a3ddf4924511156cbc878868877997cd1fa44bfbc37fdadba1ee9bcb O(S₅)H₂(Db₃Os)Md(Pa₇)

100% Preinstall exfiltrates system info

2025-02-02-@optimystic99_dev-utils v1.0.17 Apr 24 malicious-software-packages-dataset

17fd6d4832d7b5cf48fbf889450b2d3242b88a41eaf8832f0fcd389f663915cd O₂(AsS₄)H₄(Cm₅CrDb₈F₃)Md(Pa₃)

100% postinstall pipes curl to node

2025-12-20-@ikarem_telemetry v100.1.8 Apr 24 malicious-software-packages-dataset

1938892458d64c073d47d4427c525e3709729861b7d87c0742869ca361f18074 O(S₃)H₃(Cm₂Db₄Os₃)Md(Pa₇)

100% Exfiltrates system info via install hooks

2025-12-22-@ikarem_telemetry v100.2.1 Apr 24 malicious-software-packages-dataset

1a84e4c8530a9390564fadc1a1b83e9554ecc031d124876c2ff9aeff54ba74a4 O(S₃)H₄(Cm₄Db₄Os₃Po)Md₂(InPa₆)

100% Malicious install hooks exfiltrate data

2025-12-12-@ikarem_telemetry v99.99.99 Apr 24 malicious-software-packages-dataset

21efd017e201dadbdb2a1330c321f93fd3ee24efbc1ff82bbe447c9c94a5e83d O(S₃)H₃(Db₃OsPo)Md(Pa₅)

67% Postinstall hook in canary package

2025-02-05-@optimystic99_dev-utils v1.0.22 Apr 24 malicious-software-packages-dataset

22c03ea56ca61f066b34dbf1b662904580f74e0de3ce685fd1075b2152998194 O₂(S₃As₂)H₆(Cm₉CrDb₁₀F₃OsPo₂)Md₂(InPa₂)

100% postinstall fetches and executes remote code

2025 08-21-react-dhtml-v3.1.7 Apr 24 malicious-software-packages-dataset

2c302aad41f8ac81022d056129b8155b90d4ff7f73fde5a4b9dc6cc5835930fd K(Li)O₃(Dy₃As₂S)H₅(Cm₅Db₈Os₅Po₇Ti)Md₂(LiPa₃)

96% Exfiltrates system data to remote server

2025-12-19-@ikarem_telemetry v100.1.1 Apr 24 malicious-software-packages-dataset

328ddd9b77a05acba1f614b4af25fb9ef54fa0d5b7c8d4cfcd2bb347301a6f92 O(S₇)H₂(Db₃Os)Md(Pa₇)

100% Preinstall exfiltrates system info

2026 01-03-chai-as-executed-v2.3.2 Apr 24 malicious-software-packages-dataset

3a0ea23941909404e590870c0aca23bb2c974307f2b0ae72ba81ef675cd7e649 K₂(McLi)O₃(C₃As₂S)H₅(Cm₉Db₈Os₂Po₈Ti)Md₄(InLiPa₃)

100% Remote code execution via base64

2025 03-16-assert_cmd-v0.10.1 Apr 24 malicious-software-packages-dataset

40be5002485baffe35ca5d20e1888bd55f5b1c7f9509698caf2ebf9338031299 O₂(S₆Eu)H₂(CmDb₂)Md(Pa₃)

100% preinstall exfiltrates /etc/passwd

2025-12-14-@ikarem_telemetry v100.0.7 Apr 24 malicious-software-packages-dataset

41da359ac9afbca5ff82445271f298f3fb4c89f0290c9ca05799f75f121bfce4 O(S₇)H₃(Db₃OsPo)Md(Pa₇)

100% Preinstall exfiltrates system info to ngrok

2025-12-19-@ikarem_telemetry v100.1.2 Apr 24 malicious-software-packages-dataset

4b99a36b277e3e64655e6a7b3da3463d068d0179ebd4d70e65011ea452dbd3a5 O(S₇)H₂(Db₃Os)Md(Pa₇)

100% Preinstall exfiltrates system info

2025 08-05-dionisio-v2.0.0 Apr 24 malicious-software-packages-dataset

4e4933d0da6489bb6d0e801ab2dd01ca0951fab22cd265d977b887ff41f7fed5 O₂(S₇Eu)H₃(CmDb₂Po)Md(Pa₄)

100% preinstall exfiltrates system data

2025-12-20-@ikarem_telemetry v100.1.5 Apr 24 malicious-software-packages-dataset

4f9e2ea476e553c22d15c56dce535e387c0a266d02bc7beab036c981d6cb3337 O(S₃)H₃(Cm₂Db₄Os₃)Md(Pa₇)

100% Exfiltrates system info via install hooks

2025-01-30-@optimystic99_dev-utils v1.0.11 Apr 24 malicious-software-packages-dataset

598217bfa15a985eb6015015eef8660679211b19786a5b658b0a73cdf90bf3b7 O₂(AsS₄)H₅(Cm₆CrDb₈F₃Po)Md(Pa₃)

100% postinstall pipes curl to node

2025 09-19-package-x-v2.0.0 Apr 24 malicious-software-packages-dataset

646f9448e3c61c1d3a4b3377efddca5a50648c4772108bc847d12b8ffde4c861 O₃(S₂CEu)H₅(Cm₃Db₆FOs₂Po₃)Md₃(InPa₃)

100% Exfiltrates environment via preinstall hook

2025-12-14-@ikarem_telemetry v100.0.6 Apr 24 malicious-software-packages-dataset

66c44044a3a86e1479b23a47ca46e5a97ee90fc31627785b8c36e362417171db O(S₇)H₃(Db₃OsPo)Md(Pa₇)

100% Preinstall exfiltrates system info

2025-02-04-@optimystic99_dev-utils v1.0.18 Apr 24 malicious-software-packages-dataset

7813916505ac926321dc883b8871f71a3980a08657722764803080be44c0e00a O₂(AsS₄)H₄(Cm₅CrDb₈F₃)Md(Pa₃)

100% postinstall pipes curl to node

2025 10-01-summerfi-typescript-config-security-notice-v1.0.0 Apr 24 malicious-software-packages-dataset

7bce3a1ab639d0403962d0095cb03e44b42da4a0c2d4ae635dd7f06b3af0b7bb O(S)H(Db₂)Md(Pa₂)

83% Dependency confusion attack package

2025-12-14-@ikarem_telemetry v100.0.1 Apr 24 malicious-software-packages-dataset

7c321bf63dbbbd043bfb82ef0d82fe860deb24b6327055bce3b9c89b3d8f6d82 O(S₅)H₂(Db₃Os)Md(Pa₇)

100% Preinstall exfiltrates system info

2025-01-31-@optimystic99_dev-utils v1.0.14 Apr 24 malicious-software-packages-dataset

84ad64e3919a71502d3e2ce225640fffd84268d2cdbdbaaa602a57059ce3fc88 O₂(AsS₄)H₄(Cm₆CrDb₈F₃)Md(Pa₃)

100% postinstall pipes curl to node

2025 08-10-xo-credit-components-v88.8.9 Apr 24 malicious-software-packages-dataset

8aeb3ee4c0d218ac83ae56e77844be805d8bfb532fe45cfc79611438ec3c40b9 O(S₂)H(Db₂)Md(Pa₅)

100% Malicious npm dependency injection

2026 01-09-chai-as-executed-v2.3.4 Apr 24 malicious-software-packages-dataset

99dea42e2d04a4a33e9b8fcc8a6a5e1a95038a09faa83466d751c43135ad5848 K₂(McLi)O₃(C₂As₂S)H₅(Cm₉Db₇Os₂Po₈Ti)Md₄(InLiPa₃)

100% Remote code execution via C2

2025-12-19-@ikarem_telemetry v100.1.0 Apr 24 malicious-software-packages-dataset

9d4c5da65dfacebd6f37644bd42024cdecb37c26d34d78b83c2f55bdd74aa128 O(S₇)H₂(Db₃Os)Md(Pa₇)

100% Preinstall exfiltrates system info

2025-12-19-@ikarem_telemetry v100.0.9 Apr 24 malicious-software-packages-dataset

9e4ef603e5c281edaf91b78a6314743906398307f80128b35dd658f265e78d5e O(S₇)H₂(Db₃Os)Md(Pa₇)

100% Preinstall hook exfiltrates system info